Is CVE-2018-20834 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-20834 being exploited in the wild.

How severe is CVE-2018-20834?

Low severity, with a CVSS score of 3, published 1 May 2019.

Which products and versions are affected?

tar (npm) SEMVER:introduced=3.0.0,fixed=4.4.2.

Is there a fix for CVE-2018-20834?

Yes. tar (npm): upgrade to 4.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-20834 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-20834?

Check whether you run tar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-20834: npm tar arbitrary file overwrite via hardlink

CVE-2018-20834 · Severity: low · CVSS 3 · Published 2019-05-01

The tar library used by npm for extracting compressed archives contains a flaw that allows an attacker to overwrite arbitrary system files. When extracting a specially crafted tarball containing hardlinks and matching files, the library will replace critical system files with attacker-controlled content, potentially enabling code execution or system compromise.

Technologies: tar (npm). Vendors: npm.

Quick answers

Is CVE-2018-20834 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-20834 being exploited in the wild.
How severe is CVE-2018-20834?: Low severity, with a CVSS score of 3, published 1 May 2019.
Which products and versions are affected?: tar (npm) SEMVER:introduced=3.0.0,fixed=4.4.2.
Is there a fix for CVE-2018-20834?: Yes. tar (npm): upgrade to 4.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-20834 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-20834?: Check whether you run tar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tar (npm): upgrade to 4.4.2 or later
```
npm install tar@4.4.2
```

Technical details

The vulnerability exists in npm's tar package (versions below 4.4.2 for 4.x and 2.2.2 for 2.x) and is rooted in improper handling of hardlinks during tarball extraction. When extracting a tarball, if it contains a hardlink pointing to a file that already exists on the system, and the archive also contains content matching that hardlink target, the extraction process overwrites the existing file with the archive contents without proper validation. This is a path traversal variant (CWE-59) exploitable via malicious tarball contents, requiring only that a user extract an untrusted archive. No authentication or special privileges are required on the part of the attacker. The vulnerability was patched by upgrading the underlying fstream dependency and removing flawed hardlink override logic.

Affected products

npm tar below 4.4.2 for 4.x; below 2.2.2 for 2.x

Identifiers

CVE-2018-20834
GHSA-j44m-qm6p-hp7m

Timeline

2019-05-01: disclosed
2019-05-14: patched

References

https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.