CVE-2021-38511

Vulnerability

The tar crate for Rust versions prior to 0.4.36 contains a path traversal vulnerability in the Archive::unpack function. When extracting a TAR archive that includes symbolic links (symlinks) with link names such as .., the library does not properly validate the symlink target. This allows subsequent archive entries to create directories outside the intended extraction directory by following the symlink. [2][3]

Exploitation

An attacker can craft a malicious TAR archive containing a symlink entry pointing to .. (or a similar traversal path), followed by a file entry whose path leverages the symlink to target a directory outside the extraction base. The attacker does not require any authentication or special privileges; the victim only needs to extract the archive using the affected tar crate. A proof-of-concept is available in the advisory. [3]

Impact

Successful exploitation allows an attacker to create arbitrary directories on the filesystem where the archive is extracted. This could enable further attacks such as overwriting critical files or placing files in sensitive locations, leading to high integrity impact. No confidentiality or availability impact is expected. [2]

Mitigation

The vulnerability is fixed in tar version 0.4.36, released on August 8, 2021. Users should update to >=0.4.36 immediately. No workaround is available for earlier versions. The CVE is not listed on the Known Exploited Vulnerabilities (KEV) catalog. [2]