QID 980369

QID 980369: Nodejs (npm) Security Update for tar (GHSA-5955-9wpr-37jh)

Security update has been released for tar to fix the vulnerability.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory.

This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\path`. If the drive letter does not match the extraction target, for example `D:\extraction\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target directory.

Additionally, a `..` portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not properly sanitized by the logic that checked for `..` within the normalized and split portions of the path.

This only affects users of `node-tar` on Windows systems.

  • CVSS V3 rated as Critical - 8.6 severity.
  • CVSS V2 rated as Medium - 4.4 severity.
    • Solution
    4.4.18 || 5.0.10 || 6.1.9Workaround:
    There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does.

    Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.
    Vendor References

    CVEs related to QID 980369

    CVE-2021-37713 |
    Software Advisories
    Advisory ID Software Component Link
    GHSA-5955-9wpr-37jh tar URL Logo github.com/advisories/GHSA-5955-9wpr-37jh
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].