CVE-2021-37701 — Path Traversal in Node-tar

CWE-22 — Path TraversalCWE-59 — Link Following7 documents6 sources
Severity
8.6HIGHNVD
CNA8.2
EPSS
0.1%
top 70.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
NPM Node-tarIsaacs Node-tarNpmjs TAR+4 more
Timeline
PublishedAug 31

Description

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories a…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HExploitability: 1.8 | Impact: 6.0

Affected Packages6 packages

▶CVEListV5npm/node-tar< 4.4.16+2
▶Debianisaacs/node-tar< 6.0.5+ds1+~cs11.3.9-1+deb11u2+3
▶npmgnu/tar3.0.0 — 4.4.16+2
▶NVDnpmjs/tar5.0.0 — 5.0.8+2

Also affects: Debian Linux 10.0, 11.0

Patches

Patch: cert-portal.siemens.com ↗Patch: github.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
OSV
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links↗2021-08-31
▶
GHSA
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links↗2021-08-31
▶
CVEList
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links↗2021-08-31
▶
OSV
CVE-2021-37701: The npm package "tar" (aka node-tar) before versions 4↗2021-08-31
▶

📋Vendor Advisories

2
Red Hat
nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite↗2021-08-31
▶
Debian
CVE-2021-37701: node-tar - The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 ha...↗2021
▶
CVE-2021-37701 — Path Traversal in NPM Node-tar | cvebase