CVE-2021-23391
📋 TL;DR
CVE-2021-23391 is a path traversal vulnerability in the Calipso package that allows malicious modules to overwrite arbitrary files during installation. This affects all versions of Calipso, putting any system using this package at risk of file system manipulation.
💻 Affected Systems
- calipso
📦 What is this software?
Calipso by Calipso Project
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through overwriting critical system files, installation of persistent backdoors, or destruction of data.
Likely Case
Unauthorized file modification leading to data loss, service disruption, or privilege escalation.
If Mitigated
Limited impact with proper file permissions and module vetting, potentially only affecting non-critical files.
🎯 Exploit Status
Exploitation requires module installation capability, which typically requires some level of access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://github.com/cliftonc/calipso
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing strict module vetting.
🔧 Temporary Workarounds
Disable module installation
allPrevent installation of new modules to block the attack vector
Modify Calipso configuration to disable module management features
Implement strict file permissions
linuxRestrict Calipso's write access to only necessary directories
chmod 755 /path/to/calipso
chown restricted_user:restricted_group /path/to/calipso
🧯 If You Can't Patch
- Implement strict access controls and audit all installed modules
- Run Calipso in a containerized environment with limited filesystem access
🔍 How to Verify
Check if Vulnerable:
Check if Calipso package is installed: npm list calipsoCheck Version:
npm list calipso --depth=0Verify Fix Applied:
Verify no Calipso installation exists or that workarounds are properly implemented📡 Detection & Monitoring
Log Indicators:
- Unusual module installation activity
- File modification outside expected directories
Network Indicators:
- Unexpected npm package downloads to Calipso instances
SIEM Query:
source="calipso" AND (event="module_install" OR event="file_write")