Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

Vulnerability

The npm package tar (node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 contains an arbitrary file creation/overwrite and arbitrary code execution vulnerability [1][2][3]. The vulnerability arises from insufficient symlink protection in the directory cache logic. When extracting a tar archive, node-tar caches paths of created directories to avoid unnecessary stat calls. However, if an archive contains both a directory and a symlink with the same name, where the names use backslashes (\) as path separators on POSIX systems, the cache checking logic incorrectly treats \ as a separator even though it is a valid filename character on POSIX. This allows an attacker to first create a directory, then replace it with a symlink, bypassing the symlink check. Additionally, on case-insensitive filesystems, a similar confusion occurs: a directory FOO followed by a symlink foo removes the directory from the filesystem but not from the internal cache, causing subsequent files within FOO to be extracted into the symlink target [2][3].

Exploitation

An attacker needs to supply a crafted tar archive to a system using a vulnerable version of node-tar. No special network position or authentication is required if the archive is extracted by a user or automated process. The attacker must include in the archive a directory entry and a subsequent symlink entry with the same name (using backslashes on POSIX or case variation on case-insensitive filesystems). The extraction process will create the directory, then replace it with a symlink pointing to an arbitrary location. A subsequent file entry within the original directory name will then be extracted into the symlink target, allowing the attacker to write files outside the intended extraction directory [2][3].

Impact

Successful exploitation allows an attacker to create or overwrite arbitrary files on the filesystem with the privileges of the process extracting the tar archive. This can lead to arbitrary code execution if the overwritten file is executable or if a configuration file is modified. The attacker gains the ability to write files to any location accessible by the extraction process, potentially escalating privileges or compromising the system [2][3].

Mitigation

The vulnerability is fixed in node-tar versions 4.4.16, 5.0.8, and 6.1.7 [2][3]. Users should update to these or later versions. The v3 branch is deprecated and did not receive a patch; users on v3 should upgrade to a supported branch. If updating is not immediately possible, a workaround is to avoid extracting untrusted tar archives with vulnerable versions, or to use the preservePaths: false option (default) which provides some protection but may not fully mitigate this issue [1][3].