Executive brief
tar-fs is a Node.js library used to extract and create tar archives. An attacker can craft a malicious tarball that, when extracted, overwrites arbitrary files on the system by exploiting how hardlinks are processed during extraction. This could allow an attacker to replace critical application files or configuration with malicious content.
Technical details
The vulnerability is an improper input validation issue (CWE-20) in tar-fs before version 1.16.2 affecting hardlink extraction. When extracting a tarball containing a hardlink to an existing file followed by a plain file with the same name, the library fails to properly validate that the hardlink target is within the extraction directory, allowing the hardlink to reference files outside the intended extraction path. An attacker can exploit this by crafting a specially constructed tarball and providing it to an application that uses tar-fs to extract archives. The fix, implemented in commit 06672828, restricts hardlink targets to be within the tar archive's contents by using path normalization.
Affected products
- tar-fs tar-fs before 1.16.2
Timeline
- 2019-04-30: disclosed
- 2019-05-01: advisory
- 2019: patched: Fixed in version 1.16.2