Executive brief
The node-tar library, a popular tool for handling compressed archive files in Node.js applications, contains a vulnerability that fails to properly sanitize file paths. If a user is tricked into extracting a specially crafted archive, an attacker could create or overwrite sensitive files anywhere on the system. This could lead to a complete system takeover or unauthorized modification of critical application data.
Technical details
The node-tar library (aka tar) fails to properly sanitize absolute paths when extracting archives. While it attempts to convert absolute paths to relative ones by stripping the root (e.g., converting /etc/passwd to etc/passwd), it only performs this operation once. An attacker can bypass this by using repeated path roots (e.g., ////etc/passwd), which results in a path that still resolves as absolute after a single strip operation. This allows for arbitrary file creation, overwrite, and potentially remote code execution if sensitive system or application files are replaced. The vulnerability is fixed in versions 3.2.2, 4.4.14, 5.0.6, and 6.1.1.
Affected products
- npm tar <3.2.2, 4.0.0 - <4.4.14, 5.0.0 - <5.0.6, 6.0.0 - <6.1.1
Timeline
- 2021-07-23: patched: Fix committed to repository
- 2021-08-03: disclosed: GitHub Advisory published
- 2021-08-03: advisory: NVD published CVE-2021-32804
References
- https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9
- https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://github.com/npm/node-tar
- https://www.npmjs.com/advisories/1770
- https://www.npmjs.com/package/tar