Arbitrary File Creation and Code Execution in npm package "tar"
Summary
CVE-2021-37701: The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. Affects nodejs across 2 version ranges.
< 12.22.6-r0
< fd6accba697070560f301604b8f5f7e2995a2a8b
Fixed in 12.22.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The npm package "tar", also known as node-tar, is a library used for creating and extracting tar archives in Node.js applications. It aims to prevent the extraction of files whose location would be modified by a symbolic link. To achieve this, it ensures that extracted directories are not symlinks and caches paths to avoid unnecessary stat calls. However, a vulnerability in versions before 4.4.16, 5.0.8, and 6.1.7 allowed for arbitrary file creation and code execution.
Vulnerability Detail
The vulnerability arises when extracting tar files that contain both a directory and a symlink with the same name as the directory. If the symlink and directory names in the archive entry use backslashes as a path separator on POSIX systems, the cache checking logic used by node-tar can be bypassed. This allows an untrusted tar file to symlink into an arbitrary location and extract arbitrary files, leading to arbitrary file creation and overwrite. Additionally, on case-insensitive filesystems, a similar confusion can occur, where the creation of a symbolic link removes a directory from the filesystem but not from the internal directory cache, resulting in files being placed in the target of the symbolic link.
How To Fix
Minimum fixed version
12.22.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is available in the referenced GHSA-9r2w-394v-53qc. Please refer to the provided GHSA for detailed instructions.
Conclusion
The npm package "tar" (node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 is vulnerable to arbitrary file creation and code execution. It is recommended to update to the latest versions or apply the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
This vulnerability allows an attacker to create or overwrite arbitrary files on the system and execute arbitrary code, potentially leading to further compromise of the system.
Versions before 4.4.16, 5.0.8, and 6.1.7 of the npm package "tar" are affected by this vulnerability.
There are currently no known exploits for this vulnerability.
Yes, updating to versions 4.4.16, 5.0.8, or 6.1.7 of the npm package "tar" will fix this vulnerability.
Yes, the provided workaround can be used if updating the package is not feasible.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
