Executive brief
The tar library used by npm for extracting compressed archives contains a flaw that allows an attacker to overwrite arbitrary system files. When extracting a specially crafted tarball containing hardlinks and matching files, the library will replace critical system files with attacker-controlled content, potentially enabling code execution or system compromise.
Technical details
The vulnerability exists in npm's tar package (versions below 4.4.2 for 4.x and 2.2.2 for 2.x) and is rooted in improper handling of hardlinks during tarball extraction. When extracting a tarball, if it contains a hardlink pointing to a file that already exists on the system, and the archive also contains content matching that hardlink target, the extraction process overwrites the existing file with the archive contents without proper validation. This is a path traversal variant (CWE-59) exploitable via malicious tarball contents, requiring only that a user extract an untrusted archive. No authentication or special privileges are required on the part of the attacker. The vulnerability was patched by upgrading the underlying fstream dependency and removing flawed hardlink override logic.
Affected products
- npm tar below 4.4.2 for 4.x; below 2.2.2 for 2.x
Timeline
- 2019-05-01: disclosed
- 2019-05-14: patched