Bug 1999739 (CVE-2021-37712) - CVE-2021-37712 nodejs-tar: insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite
Summary: CVE-2021-37712 nodejs-tar: insufficient symlink protection due to directory c...
Keywords:
Status: NEW
Alias: CVE-2021-37712
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1999740 1999741 2002177 2003774 2002172 2002173 2002174 2002175 2002176 2002307 2008479 2008480 2008481 2008482 2008483 2008484
Blocks: 1999747
TreeView+ depends on / blocked
 
Reported: 2021-08-31 16:47 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-11-15 08:06 UTC (History)
42 users (show)

Fixed In Version: nodejs-tar 4.4.18, nodejs-tar 5.0.10, nodejs-tar 6.1.9
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the npm package "tar" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2021-08-31 16:47:46 UTC
node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.

This logic was insufficient when extracting tar files that contained two directories and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include directories with two forms of the path that resolve to the same file system entity, followed by a symbolic link with a name in the first form, lastly followed by a file using the second form. It led to bypassing node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.

Reference:
https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p

Comment 1 Guilherme de Almeida Suckevicz 2021-08-31 16:48:10 UTC
Created nodejs-tar tracking bugs for this issue:

Affects: epel-7 [bug 1999741]
Affects: fedora-all [bug 1999740]


Note You need to log in before you can comment on or make changes to this bug.