CVE-2021-32803: Arbitrary File Creation/Overwrite in tar

Background

The 'tar' package is an npm module used for creating and extracting tar archives in Node.js applications. It provides functionality to compress and decompress files and directories. The vulnerability identified as CVE-2021-32803 allows an attacker to create or overwrite arbitrary files on the system by exploiting insufficient symlink protection in the 'node-tar' module, which is used by 'tar'. This vulnerability can lead to arbitrary code execution and poses a high risk to affected systems.

Vulnerability Detail

The vulnerability arises from a flaw in the logic of 'node-tar' when extracting tar files that contain both a directory and a symlink with the same name as the directory. Due to the order of operations, the directory is created and added to the 'node-tar' directory cache before symlink checks are performed. This allows an attacker to first create a directory and then replace it with a symlink, bypassing symlink checks on directories. As a result, an untrusted tar file can symlink into an arbitrary location and extract arbitrary files, leading to arbitrary file creation and overwrite. The impact of this vulnerability includes arbitrary file creation, arbitrary file overwrite, and potential arbitrary code execution.

npm install tar@7.5.22

Workaround

If upgrading is not immediately possible, users can implement a custom 'filter' method to prevent the extraction of symbolic links. The following code snippet demonstrates how to create a custom filter method:

const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  filter: (file, entry) => {
    if (entry.type === 'SymbolicLink') {
      return false
    } else {
      return true
    }
  }
})

Conclusion

The vulnerability CVE-2021-32803 in the 'tar' package allows for arbitrary file creation and overwrite, potentially leading to arbitrary code execution. It is crucial to upgrade to the latest patch version (3.2.3, 4.4.15, 5.0.7, or 6.1.2) or implement the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tar →

FAQ