Is CVE-2021-37713 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-37713 being exploited in the wild.

How severe is CVE-2021-37713?

Low severity, with a CVSS score of 3.1, published 31 August 2021.

Which products and versions are affected?

tar (npm) SEMVER:introduced=0,fixed=4.4.18.

Is there a fix for CVE-2021-37713?

Yes. tar (npm): upgrade to 4.4.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-37713 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2021-37713?

Check whether you run tar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-37713: npm tar arbitrary file creation via path traversal on Windows

CVE-2021-37713 · Severity: low · CVSS 3.1 · Published 2021-08-31

The npm tar package is used to extract and manipulate tar archive files across many Node.js applications. On Windows systems, the package's path sanitization logic fails to properly restrict file extraction to the intended directory, allowing an attacker to craft a malicious tar archive that extracts files outside the target location. This could enable arbitrary file overwrites or creation of executable files, potentially leading to code execution or data tampering.

Technologies: tar (npm). Vendors: npm.

Quick answers

Is CVE-2021-37713 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-37713 being exploited in the wild.
How severe is CVE-2021-37713?: Low severity, with a CVSS score of 3.1, published 31 August 2021.
Which products and versions are affected?: tar (npm) SEMVER:introduced=0,fixed=4.4.18.
Is there a fix for CVE-2021-37713?: Yes. tar (npm): upgrade to 4.4.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-37713 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2021-37713?: Check whether you run tar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tar (npm): upgrade to 4.4.18 or later
```
npm install tar@4.4.18
```

Technical details

A path traversal vulnerability in node-tar's Windows path handling allows extraction of files outside the intended extraction target directory. The root cause is insufficient sanitization of drive-relative paths (e.g., C:some\path) and drive-prefixed directory traversal sequences (e.g., C:../foo). When a tar archive contains an entry with a path that specifies a different drive letter from the extraction target on Windows, the path.resolve() call resolves against the current working directory of that drive rather than the extraction target, bypassing containment checks. Additionally, paths with a drive letter followed immediately by .. (like c:../) were not caught by the existing directory traversal filter. The vulnerability affects Windows systems only. Patches in versions 4.4.18, 5.0.10, and 6.1.9 strip path roots from all paths before resolution and add defense-in-depth checks to skip extraction of entries that would escape the target directory.

Affected products

npm tar all versions before 4.4.18; 5.0.0 to 5.0.9; 6.0.0 to 6.1.8

Identifiers

CVE-2021-37713
GHSA-5955-9wpr-37jh

Timeline

2021-08-31: disclosed: Advisory published
2021-08-31: patched: Patches released in versions 4.4.18, 5.0.10, 6.1.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.