Listen to this Post
The vulnerability in node-tar library versions up to 7.5.2 arises from insufficient sanitization of the linkpath field for Hardlink and SymbolicLink entries during TAR archive extraction. By default, when preservePaths is false, the library intends to restrict extraction to a designated root directory. However, in the src/unpack.ts file, the
and [bash] methods fail to properly validate resolved paths. For hardlinks, the code uses path.resolve(this.cwd, entry.linkpath) to determine the target. If entry.linkpath is an absolute path, Node.js's path.resolve ignores this.cwd and returns the absolute path directly. The library does not check if this resolved target remains within the extraction root, allowing a malicious archive to create a hardlink to any file on the host system, such as /etc/passwd. Subsequent writes to this hardlink can overwrite the target file if permissions permit, bypassing path-based security. For symbolic links, the entry.linkpath is passed directly to fs.symlink without validation, enabling the creation of symlinks pointing to absolute system paths or directory traversal sequences (e.g., ../..). This symlink poisoning can lead to unauthorized access or manipulation of sensitive files outside the extraction directory. The combination of these flaws allows attackers to achieve arbitrary file overwrite and symlink-based attacks even with secure default settings, posing significant risks in environments where TAR archives are processed automatically. Platform: node-tar Version: <= 7.5.2 Vulnerability: Arbitrary file overwrite Severity: Critical date: Unspecified <h2 style="color: blue;">Prediction: Patch expected soon</h2> <h2 style="color: blue;">What Undercode Say:</h2> <h2 style="color: blue;">Analytics</h2> [bash] Create a directory and secret file for testing mkdir out_repro echo "ORIGINAL_DATA" > secret.txt Generate malicious TAR archive using Node.js script (save as exploit.js) node exploit.js Extract archive with node-tar (default settings) cd out_repro && tar -xvf ../exploit.tar Verify hardlink overwrite cat secret.txt Check symlink target readlink exploit_sym
// exploit.js - PoC script to create malicious TAR
const fs = require('fs');
const path = require('path');
const tar = require('tar');
// Script as provided in PoC
How Exploit:
Craft TAR with absolute hardlink and symlink entries. Extract using node-tar <=7.5.2. Hardlink overwrites target file. Symlink points to sensitive path.
Protection from this CVE
Update node-tar version. Apply patches. Validate linkpaths.
Impact:
Arbitrary file overwrite. Symlink poisoning. Potential RCE.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
