esm.sh CDN-Dienst hat willkürliches Dateischreiben über tarslip in github.com/esm-dev/esm.sh

The Arbitrary File Access vulnerability in esm.sh allows an attacker to write files to the server's filesystem. This is a critical security risk because it bypasses normal access controls. A successful exploit could allow an attacker to overwrite critical system files, inject malicious code (e.g., a reverse shell), or modify configuration files to gain persistent access. The impact is particularly severe because esm.sh is a CDN, meaning it serves JavaScript modules to numerous websites and applications. Compromise of esm.sh could therefore lead to widespread code injection across many downstream applications, creating a significant supply chain attack vector. The ability to write arbitrary files effectively grants the attacker a high degree of control over the affected system.

Organizations relying on the esm.sh CDN service for delivering JavaScript packages are at risk. This includes developers and teams using Node.js, React, Angular, or other JavaScript-based frameworks. Specifically, those using older versions of the github.com/esm-dev/esm.sh component are vulnerable.

• go: Inspect the github.com/esm-dev/esm.sh component for versions prior to 0.0.0-20251117232647-9d77b88c3207 using go list -m github.com/esm-dev/esm.sh. • generic web: Monitor CDN logs for unusual file write activity, particularly requests containing suspicious file paths or payloads. • generic web: Use curl to probe for potential file write endpoints, attempting to write files to unexpected locations. Example: curl -X POST -d '...' <cdn_url>/path/to/potential/write/endpoint

1. 2025-11-25Disclosure

   disclosure

1. Reserviert2025-11-13
2. Veröffentlicht2025-11-25
3. Geändert2026-03-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-65025 is to immediately upgrade to version 0.0.0-20251117232647-9d77b88c3207 or later. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. While a direct WAF rule to prevent arbitrary file writes is difficult, carefully reviewing and restricting file upload paths within your applications using esm.sh modules can reduce the attack surface. Monitor esm.sh's status page and security advisories for further guidance. After upgrading, confirm the fix by attempting to trigger the vulnerable file write operation and verifying that it is now blocked.