Executive brief
npm tar is a widely-used library for extracting tar archives in Node.js applications. A flaw in symlink protection allows attackers to extract a malicious tar file that creates or overwrites arbitrary files on the system. By crafting a tar archive that first creates a directory and then replaces it with a symbolic link, an attacker can bypass the library's safeguards and write files to unexpected locations, potentially leading to code execution or data corruption.
Technical details
The vulnerability is a directory cache poisoning flaw in npm tar's symlink protection logic. The library maintains a cache of created directories to optimize performance and prevent symlink attacks. However, when a tar archive contains both a directory and a symlink with the same name, the directory is cached first. Subsequent mkdir calls for that path are then skipped, and critically, the symlink validation that normally occurs during mkdir is also bypassed. An attacker can exploit this by crafting a tar file that creates a directory, then replaces it with a symlink pointing to an arbitrary location, enabling arbitrary file creation and overwrite. The vulnerability affects npm tar versions 3.0.0–3.2.2, 4.0.0–4.4.14, 5.0.0–5.0.6, and 6.0.0–6.1.1, and is fixed in versions 3.2.3, 4.4.15, 5.0.7, and 6.1.2.
Affected products
- npm tar <3.2.3 || 4.x <4.4.15 || 5.x <5.0.7 || 6.x <6.1.2
Timeline
- 2021-08-03: disclosed
- 2021-08-03: patched: Fixed in versions 3.2.3, 4.4.15, 5.0.7, and 6.1.2