CVE-2021-37701: npm tar symlink bypass in directory cache poisoning

CVE-2021-37701 · Severity: low · CVSS 3.1 · Published 2021-08-31

npm tar is a popular Node.js library for extracting and creating TAR archives. Due to insufficient symlink protection in directory caching, an attacker can craft a malicious TAR file that bypasses security checks and writes arbitrary files to unintended locations on a system when extracted. This could allow attackers to overwrite critical files or inject malicious code into applications that process untrusted archives.

Technologies: tar (npm). Vendors: npm.

Quick answers

Is CVE-2021-37701 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-37701 being exploited in the wild.
How severe is CVE-2021-37701?
Low severity, with a CVSS score of 3.1, published 31 August 2021.
Which products and versions are affected?
tar (npm) SEMVER:introduced=3.0.0,fixed=4.4.16.
Is there a fix for CVE-2021-37701?
Yes. tar (npm): upgrade to 4.4.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-37701 attacked?
It is attacked with local access.
Am I affected by CVE-2021-37701?
Check whether you run tar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tar (npm): upgrade to 4.4.16 or later
    npm install tar@4.4.16

Technical details

The vulnerability exists in node-tar's directory extraction logic, which caches directories to avoid redundant filesystem stat calls. When extracting a TAR archive containing both a directory and a symlink with the same name (exploiting backslash path separators on POSIX systems or case-insensitivity), an attacker can replace a cached directory with a symlink and bypass symlink security checks. The cache normalization used both forward and backward slashes as path separators, but backslash is a valid filename character on POSIX systems. By creating a directory entry followed by a symlink entry with the same name, the library would treat them as separate entries, allowing subsequent file extraction to follow the symlink to an arbitrary location. Patches were released in versions 4.4.16, 5.0.8, and 6.1.7, which normalize all paths to use forward slashes and perform case-insensitive cache pruning.

Affected products

  • npm tar <4.4.16, 5.0.0-5.0.7, 6.0.0-6.1.6

Identifiers

  • CVE-2021-37701
  • GHSA-9r2w-394v-53qc

Timeline

  • 2021-08-31: disclosed
  • 2021-08-31: patched: Patches released in versions 4.4.16, 5.0.8, and 6.1.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.