CVE-2016-3956 (JavaScript, published 2016-07-02T14:59Z)
Description: value: The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/npm/npm
Files changed:
doc/cli/npm-adduser.md
lib/cache.js
lib/config/get-credentials-by-uri.js
lib/utils/map-to-registry.js
test/tap/bearer-token-check.js
test/tap/config-credentials.js
test/tap/map-to-registry.js
Commit message: config: only send token to registry hosts

Fixes: #8380
Credit: @othiym23
Reviewed-By: @zkat


Vulnerable code:
include an authorization header. See `always-auth` in `npm-config(7)` for more
details on always-auth. Registry-specific configuration of `always-auth` takes
precedence over any global configuration.
        mapToRegistry(spec, npm.config, function (err, uri, auth) {
  if (this.get(nerfed + ':always-auth') !== undefined) {
    var val = this.get(nerfed + ':always-auth')
    c.alwaysAuth = val === 'false' ? false : !!val
  } else if (this.get('always-auth') !== undefined) {
    c.alwaysAuth = this.get('always-auth')
  }

  var uri = url.resolve(normalized, name)
  cb(null, uri, auth, normalized)
      alwaysAuth: undefined
      alwaysAuth: undefined
      alwaysAuth: undefined
      alwaysAuth: undefined

Fixed code:
include an authorization header. This setting may be necessary for use with
private registries where metadata and package tarballs are stored on hosts with
different hostnames. See `always-auth` in `npm-config(7)` for more details on
always-auth. Registry-specific configuration of `always-auth` takes precedence
over any global configuration.
        mapToRegistry(p.raw, npm.config, function (err, uri, auth) {
  // used to override scope matching for tokens as well as legacy auth
  if (this.get(nerfed + ':always-auth') !== undefined) {
    var val = this.get(nerfed + ':always-auth')
    c.alwaysAuth = val === 'false' ? false : !!val
  } else if (this.get('always-auth') !== undefined) {
    c.alwaysAuth = this.get('always-auth')
  }

  var uri
  log.silly('mapToRegistry', 'data', data)
  if (data.type === 'remote') {
    uri = data.spec
  } else {
    uri = url.resolve(normalized, name)
  }

  cb(null, uri, scopeAuth(uri, registry, auth), normalized)
}

function scopeAuth (uri, registry, auth) {
  var cleaned = {
    scope: auth.scope,
    email: auth.email,
    alwaysAuth: auth.alwaysAuth,
    token: undefined,
    username: undefined,
    password: undefined,
    auth: undefined
  }

  var requestHost
  var registryHost

  if (auth.token || auth.auth || (auth.username && auth.password)) {
    requestHost = url.parse(uri).hostname
    registryHost = url.parse(registry).hostname

    if (requestHost === registryHost) {
      cleaned.token = auth.token
      cleaned.auth = auth.auth
      cleaned.username = auth.username
      cleaned.password = auth.password
    } else if (auth.alwaysAuth) {
      log.verbose('scopeAuth', 'alwaysAuth set for', registry)
      cleaned.token = auth.token
      cleaned.auth = auth.auth
      cleaned.username = auth.username
      cleaned.password = auth.password
    } else {
      log.silly('scopeAuth', uri, "doesn't share host with registry", registry)
    }
  }

  return cleaned
var resolve = require('path').resolve
var writeFileSync = require('graceful-fs').writeFileSync

var mkdirp = require('mkdirp')
var mr = require('npm-registry-mock')
var osenv = require('osenv')
var rimraf = require('rimraf')
var test = require('tap').test

var common = require('../common-tap.js')
var toNerfDart = require('../../lib/config/nerf-dart.js')

var pkg = resolve(__dirname, 'install-bearer-check')
var outfile = resolve(pkg, '_npmrc')
var modules = resolve(pkg, 'node_modules')
var tarballPath = '/scoped-underscore/-/scoped-underscore-1.3.1.tgz'
// needs to be a different hostname to verify tokens (not) being sent correctly
var tarballURL = 'http://lvh.me:' + common.port + tarballPath
var tarball = resolve(__dirname, '../fixtures/scoped-underscore-1.3.1.tgz')

var server

var EXEC_OPTS = { cwd: pkg }

function mocks (server) {
  var auth = 'Bearer 0xabad1dea'
  server.get(tarballPath, { authorization: auth }).reply(403, {
    error: 'token leakage',
    reason: 'This token should not be sent.'
  })
  server.get(tarballPath).replyWithFile(200, tarball)
}

test('setup', function (t) {
  mr({ port: common.port, plugin: mocks }, function (er, s) {
    server = s
    t.ok(s, 'set up mock registry')
    setup()
    t.end()
  })
})

test('authed npm install with tarball not on registry', function (t) {
  common.npm(
    [
      'install',
      '--loglevel', 'silent',
      '--json',
      '--fetch-retries', 0,
      '--userconfig', outfile
    ],
    EXEC_OPTS,
    function (err, code, stdout, stderr) {
      t.ifError(err, 'test runner executed without error')
      t.equal(code, 0, 'npm install exited OK')
      t.notOk(stderr, 'no output on stderr')
      try {
        var results = JSON.parse(stdout)
      } catch (ex) {
        console.error('#', ex)
        t.ifError(ex, 'stdout was valid JSON')
      }

      if (results) {
        var installedversion = {
          'version': '1.3.1',
          'from': '>=1.3.1 <2',
          'resolved': 'http://lvh.me:1337/scoped-underscore/-/scoped-underscore-1.3.1.tgz'
        }
        t.isDeeply(results.dependencies['@scoped/underscore'], installedversion, '@scoped/underscore installed')
      }

      t.end()
    }
  )
})

test('cleanup', function (t) {
  server.close()
  cleanup()
  t.end()
})

var contents = '@scoped:registry=' + common.registry + '\n' +
               toNerfDart(common.registry) + ':_authToken=0xabad1dea\n'

var json = {
  name: 'test-package-install',
  version: '1.0.0'
}

var shrinkwrap = {
  name: 'test-package-install',
  version: '1.0.0',
  dependencies: {
    '@scoped/underscore': {
      resolved: tarballURL,
      from: '>=1.3.1 <2',
      version: '1.3.1'
    }
  }
}

function setup () {
  cleanup()
  mkdirp.sync(modules)
  writeFileSync(resolve(pkg, 'package.json'), JSON.stringify(json, null, 2) + '\n')
  writeFileSync(outfile, contents)
  writeFileSync(
    resolve(pkg, 'npm-shrinkwrap.json'),
    JSON.stringify(shrinkwrap, null, 2) + '\n'
  )
}

function cleanup () {
  process.chdir(osenv.tmpdir())
  rimraf.sync(pkg)
}
      alwaysAuth: false
      alwaysAuth: false
      alwaysAuth: false
      alwaysAuth: false

test('mapToRegistry token scoping', function (t) {
  npm.config.set('scope', '')
  npm.config.set('registry', 'https://reg.npm/')
  npm.config.set('//reg.npm/:_authToken', 'r-token')

  t.test('pass token to registry host', function (t) {
    mapRegistry(
      'https://reg.npm/packages/e/easy-1.0.0.tgz',
      npm.config,
      function (er, uri, auth, registry) {
        t.ifError(er, 'mapRegistryToURI worked')
        t.equal(uri, 'https://reg.npm/packages/e/easy-1.0.0.tgz')
        t.deepEqual(auth, {
          scope: '//reg.npm/',
          token: 'r-token',
          username: undefined,
          password: undefined,
          email: undefined,
          auth: undefined,
          alwaysAuth: false
        })
        t.equal(registry, 'https://reg.npm/')
      }
    )
    t.end()
  })

  t.test("don't pass token to non-registry host", function (t) {
    mapRegistry(
      'https://butts.lol/packages/e/easy-1.0.0.tgz',
      npm.config,
      function (er, uri, auth, registry) {
        t.ifError(er, 'mapRegistryToURI worked')
        t.equal(uri, 'https://butts.lol/packages/e/easy-1.0.0.tgz')
        t.deepEqual(auth, {
          scope: '//reg.npm/',
          token: undefined,
          username: undefined,
          password: undefined,
          email: undefined,
          auth: undefined,
          alwaysAuth: false
        })
        t.equal(registry, 'https://reg.npm/')
      }
    )
    t.end()
  })

  t.test('pass token to non-registry host with always-auth', function (t) {
    npm.config.set('always-auth', true)
    mapRegistry(
      'https://butts.lol/packages/e/easy-1.0.0.tgz',
      npm.config,
      function (er, uri, auth, registry) {
        t.ifError(er, 'mapRegistryToURI worked')
        t.equal(uri, 'https://butts.lol/packages/e/easy-1.0.0.tgz')
        t.deepEqual(auth, {
          scope: '//reg.npm/',
          token: 'r-token',
          username: undefined,
          password: undefined,
          email: undefined,
          auth: undefined,
          alwaysAuth: true
        })
        t.equal(registry, 'https://reg.npm/')
      }
    )
    t.end()
  })

  t.end()
})