Node.js archives serious tar handling vulnerabilities with software update

Enter the tar pit

Developers of Node.js have released a significant update to the technology that resolves five troublesome security vulnerabilities, including some that present a remote code execution risk.

The Node.js patch batch offers relief from a total of three high-severity issues and two moderate security flaws.

All involve vulnerabilities in the node-tar, arborist, and npm cli modules and relate to remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804, resolved last month.

The NPM package "tar" (aka node-tar) was susceptible to an arbitrary file creation/overwrite and arbitrary code execution vulnerability.

Path integrity controls built into the technology came unstuck when “extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems”, as explained in an a US National Vulnerability Database (NVD) write-up of the CVE-2021-37701 vulnerability.

It added:

The cache checking logic used both `\` and `/` characters as path separators, however `\` is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.”

Similar issues could arise on case-insensitive filesystems.

The same NVD alert explains: “If a tar archive contained a directory at `FOO`, followed by a symbolic link named `foo`, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but _not_ from the internal directory cache, as it would not be treated as a cache hit.

“A subsequent file entry within the `FOO` directory would then be placed in the target of the symbolic link, thinking that the directory had already been created.”

Keep it zipped

It’s not uncommon for websites to allow users to upload zip (archive) files and extract them, and this is why the tar vulnerability is particularly relevant for webadmins to patch.

Node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. The CVE-2021-37712 vulnerability violates this control, thus creating a risk from malformed tar archives similar to the CVE-2021-37701 vulnerability.

Both flaws are categorized as high-risk. The third high-risk flaw in the batch (CVE-2021-37713) creates an arbitrary file overwrite or code execution risk because of insufficient relative path sanitization, again involving node-tar.

The two other vulnerabilities covered in the patch batch involve issues with the arborist and npm cli modules. Each is categorized as moderate risk.