Listen to this Post
The vulnerability exists in the `node-tar` library within lib/unpack.js. When extracting a hardlink entry, the security validation logic and the actual hardlink creation logic use different base directories to resolve the link’s target path. The security check (
</code>) resolves the `linkpath` relative to the hardlink entry's own parent directory within the archive using `path.posix` functions. It checks if the normalized result starts with <code>../</code>. The hardlink creation function (<code>[bash]</code>) instead resolves the same `linkpath` relative to the extraction directory (<code>this.cwd</code>) using <code>path.resolve</code>. This semantic mismatch allows an attacker to craft an archive where a deep entry (e.g., <code>a/b/c/d/x</code>) has a hardlink `linkpath` like <code>../../../../etc/passwd</code>. The security check sees a normalized path without a leading `../` and passes it, while the creation function traverses out of the extraction directory to target <code>/etc/passwd</code>. Platform: Node.js tar Version: ^7.5.0 Vulnerability : Hardlink bypass Severity: Critical date: 2025-03-25 <h2 style="color: blue;">Prediction: 2025-04-15</h2> <h2 style="color: blue;">What Undercode Say:</h2> [bash] npm install tar@^7.5.0 node create-malicious-tar.js curl -X POST --data-binary @malicious.tar http://localhost:3000/upload curl http://localhost:3000/read
How Exploit:
1. Attacker crafts TAR.
2. Contains deep hardlink entry.
3. Link target uses `../` traversal.
4. Upload to vulnerable endpoint.
5. Security check passes.
6. Hardlink created outside.
7. Read/Write via link.
Protection from this CVE
Update `node-tar` library.
Validate archives pre-extraction.
Use chroot/jail extraction.
Restrict process file permissions.
Implement mandatory access controls.
Impact:
Arbitrary File Read
Arbitrary File Write
Remote Code Execution
Data Exfiltration
System Compromise
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
