Executive brief
npm tar is a popular Node.js library for extracting and creating TAR archives. Due to insufficient symlink protection in directory caching, an attacker can craft a malicious TAR file that bypasses security checks and writes arbitrary files to unintended locations on a system when extracted. This could allow attackers to overwrite critical files or inject malicious code into applications that process untrusted archives.
Technical details
The vulnerability exists in node-tar's directory extraction logic, which caches directories to avoid redundant filesystem stat calls. When extracting a TAR archive containing both a directory and a symlink with the same name (exploiting backslash path separators on POSIX systems or case-insensitivity), an attacker can replace a cached directory with a symlink and bypass symlink security checks. The cache normalization used both forward and backward slashes as path separators, but backslash is a valid filename character on POSIX systems. By creating a directory entry followed by a symlink entry with the same name, the library would treat them as separate entries, allowing subsequent file extraction to follow the symlink to an arbitrary location. Patches were released in versions 4.4.16, 5.0.8, and 6.1.7, which normalize all paths to use forward slashes and perform case-insensitive cache pruning.
Affected products
- npm tar <4.4.16, 5.0.0-5.0.7, 6.0.0-6.1.6
Timeline
- 2021-08-31: disclosed
- 2021-08-31: patched: Patches released in versions 4.4.16, 5.0.8, and 6.1.7