CVE-2021-37712
published 2021-08-31CVE-2021-37712: The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution…
PriorityP346high8.6CVSS 3.1
AVLACLPRNUIRSCCHIHAH
EPSS
1.85%
76.4th percentile
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | node-tar | < node-tar 6.1.11+~cs11.3.10-1 (bookworm) | node-tar 6.1.11+~cs11.3.10-1 (bookworm) |
| gnu | tar | >= 3.0.0 < 4.4.18 | 4.4.18 |
| gnu | tar | >= 5.0.0 < 5.0.10 | 5.0.10 |
| gnu | tar | >= 6.0.0 < 6.1.9 | 6.1.9 |
| isaacs | node-tar | >= 0 < 6.0.5+ds1+~cs11.3.9-1+deb11u2 | 6.0.5+ds1+~cs11.3.9-1+deb11u2 |
| isaacs | node-tar | >= 0 < 6.1.11+~cs11.3.10-1 | 6.1.11+~cs11.3.10-1 |
| isaacs | node-tar | >= 0 < 6.1.11+~cs11.3.10-1 | 6.1.11+~cs11.3.10-1 |
| isaacs | node-tar | >= 0 < 6.1.11+~cs11.3.10-1 | 6.1.11+~cs11.3.10-1 |
| npm | node-tar | < 4.4.18 | 4.4.18 |
| npm | node-tar | — | — |
| npm | node-tar | — | — |
| npmjs | tar | <= 4.4.17 | — |
| npmjs | tar | 5.0.0 – 5.0.9 | — |
| npmjs | tar | 6.0.0 – 6.1.8 | — |
| oracle | graalvm | — | — |
| oracle | graalvm | — | — |
| siemens | sinec_infrastructure_network_services | < 1.0.1.1 | 1.0.1.1 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
osv8.6HIGH
vendor_debian8.2HIGH
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC INS
cisa_ics·2022-03-10·CVSS 5.9
[MEDIUM] Siemens SINEC INS
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINEC INS
Last RevisedMarch 10, 2022
Alert CodeICSA-22-069-09
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerability: Using Components with Known Vulnerabilities
## 2. RISK EVALUATION
Successful exploitation of this vulnerability in third-party components could allow an attacker to interfere with the affected product in various ways.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Siemens reports this vulnerability affects the following SINEC INS (Infrastructure Netw
Red Hat
nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite
vendor_redhat·2021-08-31·CVSS 8.2
CVE-2021-37712 [HIGH] CWE-59 nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite
nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that
Debian
CVE-2021-37712: node-tar - The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 h...
vendor_debian·2021·CVSS 8.2
CVE-2021-37712 [HIGH] CVE-2021-37712: node-tar - The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 h...
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "s
OSV
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
osv·2021-08-31
CVE-2021-37712 [HIGH] Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
### Impact
Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution
node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.
This logic was insufficient when extracting tar files that contained two directories and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve
GHSA
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
ghsa·2021-08-31
CVE-2021-37712 [HIGH] CWE-22 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
### Impact
Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution
node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.
This logic was insufficient when extracting tar files that contained two directories and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve
OSV
CVE-2021-37712: The npm package "tar" (aka node-tar) before versions 4
osv·2021-08-31·CVSS 8.6
CVE-2021-37712 [HIGH] CVE-2021-37712: The npm package "tar" (aka node-tar) before versions 4
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "s
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393phttps://lists.debian.org/debian-lts-announce/2022/12/msg00023.htmlhttps://www.debian.org/security/2021/dsa-5008https://www.npmjs.com/package/tarhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393phttps://lists.debian.org/debian-lts-announce/2022/12/msg00023.htmlhttps://www.debian.org/security/2021/dsa-5008https://www.npmjs.com/package/tarhttps://www.oracle.com/security-alerts/cpuoct2021.html
2021-08-31
Published