Описание
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.
A flaw was found in launch-editor. This component, used in Node.js to open files, can be tricked into accessing arbitrary paths, including Windows Universal Naming Convention (UNC) paths. When a malicious UNC path is opened, Windows automatically attempts NTLM authentication to a remote server controlled by an attacker. This action leaks the user's NTLMv2 password hash, which can then be used by an attacker to compromise user credentials through offline cracking.
Отчет
Red Hat rates this issue as having Moderate impact for Red Hat OpenShift AI MLflow images on Windows client scenarios. Linux-based Red Hat Enterprise Linux AI bootc images are not affected because launch-editor UNC-path behavior is Windows-specific.
Меры по смягчению последствий
Avoid using launch-editor on Windows clients against untrusted URLs. Upgrade when updated packages are available.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | cryostat-openshift-console-plugin-npm | Not affected | ||
| Cryostat 4 | launch-editor | Not affected | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-ui-rhel8 | Not affected | ||
| Node HealthCheck Operator | workload-availability/node-healthcheck-must-gather-rhel9 | Not affected | ||
| Node HealthCheck Operator | workload-availability/node-healthcheck-operator-bundle | Not affected | ||
| Node HealthCheck Operator | workload-availability/node-healthcheck-rhel9-operator | Not affected | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-console-plugin-419-rhel9 | Not affected | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 | Not affected | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-console-plugin-rhel9 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-pf5-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
5.3 Medium
CVSS3