Symlink Attack Vulnerability in node-tar Package
Summary
CVE-2015-8860: The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive. Affects node-tar versions < 2.2.1-1. Fixed in 2.2.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-tar package is a module for Node.js that provides functionality for creating and extracting tar archives. It is commonly used in applications that require file compression and decompression. The vulnerability identified as CVE-2015-8860 allows remote attackers to write to arbitrary files by exploiting a symlink attack in an archive.
Vulnerability Detail
The vulnerability arises from a lack of proper handling of symlinks within the node-tar package. By creating a malicious tar archive that contains symlinks pointing to sensitive files, an attacker can overwrite these files with arbitrary content. This can lead to unauthorized modification of critical system files or the injection of malicious code. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
2.2.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-tarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Updating the node-tar package to the fixed version is the recommended solution.
Conclusion
The symlink attack vulnerability in the node-tar package can have serious consequences, including unauthorized modification of files and injection of malicious code. It is crucial to update the package to the fixed version (2.2.1-1 or higher) to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for node-tar →
FAQ
A symlink attack, also known as a symbolic link attack, is a technique where an attacker exploits the behavior of symbolic links to gain unauthorized access or modify files. By creating a symbolic link that points to a target file, the attacker can trick a vulnerable application into performing unintended actions on the target file.
The vulnerability allows remote attackers to overwrite arbitrary files on the system. This can lead to unauthorized modification of critical system files, injection of malicious code, or denial of service attacks.
While there may not be a specific known exploit for this vulnerability, the underlying symlink attack technique has been used in various security exploits in the past. It is important to address this vulnerability promptly to prevent potential attacks.
Yes, all versions of the node-tar package prior to version 2.2.1-1 are affected by this vulnerability. It is recommended to update to the fixed version to mitigate the risk.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for node-tar.
