Arbitrary File Creation/Overwrite Vulnerability in Node-Tar Package
Summary
UBUNTU-CVE-2021-32803: The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. Affects node-tar versions 0.1.18-1 – 0.1.18-1ubuntu0.1~esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-tar is an npm package used for handling tar file extraction and creation in Node.js applications. It aims to ensure safe extraction of files by preventing symbolic link exploitation. However, certain versions of node-tar are vulnerable to an arbitrary file creation and overwrite issue due to insufficient symlink protection, which can lead to severe security risks.
Vulnerability Detail
The vulnerability in node-tar arises from its inadequate handling of symbolic links during the extraction process. Specifically, when a tar file contains both a directory and a symlink with the same name, node-tar's logic allows the symlink to bypass checks, enabling an attacker to overwrite files in arbitrary locations. This flaw can lead to unauthorized file creation and overwriting, posing significant security threats to applications that rely on this package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using tar files from untrusted sources or ensure that the tar files do not contain both directories and symlinks with the same name.
Conclusion
The arbitrary file creation and overwrite vulnerability in the node-tar package poses significant risks to applications that utilize it. It is crucial to update to the patched versions to mitigate these risks and ensure the security of your software.
See every vulnerability recorded for node-tar →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
Versions of node-tar before 6.1.2, 5.0.7, 4.4.15, and 3.2.3 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability can lead to unauthorized file creation and overwriting, which may compromise the integrity and security of the affected application.
Yes, as a temporary measure, avoid using tar files from untrusted sources or ensure that the tar files do not contain both directories and symlinks with the same name.
Related vulnerabilities
Recent vulnerabilities recorded for node-tar.
