Bug 1999731 (CVE-2021-37701) - CVE-2021-37701 nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite
Summary: CVE-2021-37701 nodejs-tar: Insufficient symlink protection due to directory c...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-37701
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1999738 1999737 2000150 2000151 2000152 2000153 2000154 2000539 2002305 2003774 2008473 2008474 2008475 2008476 2008477 2008478 2029528 2029529 2031767 2086773 2086774 2086775 2086776 2087161
Blocks: 1999747
TreeView+ depends on / blocked
 
Reported: 2021-08-31 16:35 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-09-01 01:23 UTC (History)
50 users (show)

Fixed In Version: nodejs-tar 4.4.16, nodejs-tar 5.0.8, nodejs-tar 6.1.7
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the npm package "tar" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.
Clone Of:
Environment:
Last Closed: 2022-02-01 22:31:33 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:5086 0 None None None 2021-12-13 17:44:24 UTC
Red Hat Product Errata RHSA-2022:0041 0 None None None 2022-01-06 18:39:58 UTC
Red Hat Product Errata RHSA-2022:0246 0 None None None 2022-01-25 09:23:36 UTC
Red Hat Product Errata RHSA-2022:0350 0 None None None 2022-02-01 21:14:28 UTC
Red Hat Product Errata RHSA-2022:4914 0 None None None 2022-06-06 09:26:46 UTC

Description Guilherme de Almeida Suckevicz 2021-08-31 16:35:31 UTC
node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.

This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems.

By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.

Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created.

These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7.

Reference:
https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc

Comment 1 Guilherme de Almeida Suckevicz 2021-08-31 16:47:54 UTC
Created nodejs-tar tracking bugs for this issue:

Affects: epel-7 [bug 1999738]
Affects: fedora-all [bug 1999737]

Comment 5 Mauro Matteo Cascella 2021-09-01 10:35:20 UTC
It's also worth noting the following commit, where "the path normalization of \ to / is made more comprehensive":

https://github.com/npm/node-tar/commit/c2a0948fb7b70862f92828e7b37b622566ed367e [main, v6]
https://github.com/npm/node-tar/commit/e120d38cef8792f9dec4ee30c7d79699c419f9ef [v5]
https://github.com/npm/node-tar/commit/ce5148e12d1f9fed671e84673a4c7bd6ef743cfb [v4]

Comment 20 errata-xmlrpc 2021-12-13 17:44:22 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8

Via RHSA-2021:5086 https://access.redhat.com/errata/RHSA-2021:5086

Comment 22 errata-xmlrpc 2022-01-06 18:39:55 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2022:0041 https://access.redhat.com/errata/RHSA-2022:0041

Comment 24 errata-xmlrpc 2022-01-25 09:23:30 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:0246 https://access.redhat.com/errata/RHSA-2022:0246

Comment 25 errata-xmlrpc 2022-02-01 21:14:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:0350 https://access.redhat.com/errata/RHSA-2022:0350

Comment 26 Product Security DevOps Team 2022-02-01 22:31:29 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-37701

Comment 27 errata-xmlrpc 2022-06-06 09:26:42 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2022:4914 https://access.redhat.com/errata/RHSA-2022:4914


Note You need to log in before you can comment on or make changes to this bug.