Bug 1999731 (CVE-2021-37701) - CVE-2021-37701 nodejs-tar: insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite
Summary: CVE-2021-37701 nodejs-tar: insufficient symlink protection due to directory c...
Keywords:
Status: NEW
Alias: CVE-2021-37701
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1999737 1999738 2000151 2000539 2003774 2008476 2000150 2000152 2000153 2000154 2002305 2008473 2008474 2008475 2008477 2008478
Blocks: 1999747
TreeView+ depends on / blocked
 
Reported: 2021-08-31 16:35 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-10-15 11:51 UTC (History)
43 users (show)

Fixed In Version: nodejs-tar 4.4.16, nodejs-tar 5.0.8, nodejs-tar 6.1.7
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the npm package "tar" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2021-08-31 16:35:31 UTC
node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.

This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems.

By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.

Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created.

These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7.

Reference:
https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc

Comment 1 Guilherme de Almeida Suckevicz 2021-08-31 16:47:54 UTC
Created nodejs-tar tracking bugs for this issue:

Affects: epel-7 [bug 1999738]
Affects: fedora-all [bug 1999737]

Comment 5 Mauro Matteo Cascella 2021-09-01 10:35:20 UTC
It's also worth noting the following commit, where "the path normalization of \ to / is made more comprehensive":

https://github.com/npm/node-tar/commit/c2a0948fb7b70862f92828e7b37b622566ed367e [main, v6]
https://github.com/npm/node-tar/commit/e120d38cef8792f9dec4ee30c7d79699c419f9ef [v5]
https://github.com/npm/node-tar/commit/ce5148e12d1f9fed671e84673a4c7bd6ef743cfb [v4]


Note You need to log in before you can comment on or make changes to this bug.