CVE-2021-32804: Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
Node.js tar module could allow a local attacker to traverse directories on the system, caused by insufficient absolute path sanitization. An attacker could use a specially-crafted tar file containing "dot dot" sequences (/../) to create or overwrite arbitrary files on the system.
Other sources
The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.
The npm package "tar" (aka node-tar) has an arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-32804?
CVE-2021-32804 is a vulnerability in the npm package "tar" that allows a local attacker to traverse directories on the system.
What is the severity of CVE-2021-32804?
The severity of CVE-2021-32804 is high, with a CVSS score of 8.1 (out of 10).
How does CVE-2021-32804 affect Node.js?
CVE-2021-32804 affects Node.js through the vulnerable version of the "tar" npm package.
How can I fix CVE-2021-32804?
To fix CVE-2021-32804, you should update the "tar" npm package to version 6.1.1, 5.0.6, 4.4.14, or 3.3.2, depending on your Node.js version.
Where can I find more information about CVE-2021-32804?
You can find more information about CVE-2021-32804 at the following references: [Red Hat Advisory](https://access.redhat.com/security/cve/CVE-2021-32803), [npm Advisory](https://www.npmjs.com/advisories/1770), [GitHub Commit](https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4).