Arbitrary File Creation and Code Execution in npm package 'tar'
Summary
CVE-2021-37713: The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. Affects nodejs across 2 version ranges.
< 3e35515c09da615ac268254bed85fe43ee71e2f0
< 12.22.6-r0
Fixed in 12.22.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The npm package 'tar', also known as node-tar, is a tool used for extracting tar files in Node.js applications. It ensures that files outside the extraction target directory are not extracted. However, versions before 4.4.18, 5.0.10, and 6.1.9 have a vulnerability that allows arbitrary file creation/overwrite and code execution. This vulnerability affects Windows systems when extracting tar files with specific path configurations.
Vulnerability Detail
The vulnerability arises from the insufficient logic in handling path resolutions on Windows systems. If a tar file contains a path that is not an absolute path but specifies a different drive letter from the extraction target, the path resolution may occur in the wrong directory. Additionally, the logic fails to properly sanitize paths with '..' portions immediately after the drive letter. This vulnerability can lead to arbitrary file creation, overwrite, and code execution.
How To Fix
Minimum fixed version
12.22.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The npm package 'tar' has a vulnerability that allows arbitrary file creation/overwrite and code execution. It affects versions before 4.4.18, 5.0.10, and 6.1.9 on Windows systems. To fix this vulnerability, it is recommended to upgrade to the latest patched versions of node-tar. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
The npm package 'tar', or node-tar, is a tool used for extracting tar files in Node.js applications. It ensures that files outside the extraction target directory are not extracted.
Versions before 4.4.18, 5.0.10, and 6.1.9 of 'tar' are affected by this vulnerability.
This vulnerability affects Windows systems when extracting tar files with specific path configurations. It can lead to arbitrary file creation, overwrite, and code execution.
To fix this vulnerability, it is recommended to upgrade to the latest patched versions of node-tar (4.4.18, 5.0.10, or 6.1.9).
There is no feasible workaround for this issue other than using the updated versions of node-tar.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
