GitHub has revealed details about seven vulnerabilities in the tar packages and @npmcli/arborist, which provide functions for working with tar archives and calculating dependency trees in Node.js. The vulnerabilities allow specially crafted archives to overwrite files outside the root directory where the extraction takes place, depending on the current permissions. These issues enable the execution of arbitrary code in the system, for example, by adding commands to ~/.bashrc or ~/.profile when performed by an unprivileged user, or by replacing system files when executed with root privileges.
The danger of these vulnerabilities is exacerbated by the fact that the problematic code is used in the npm package manager during operations with npm packages, allowing an attack on users by hosting a specially crafted npm package in the repository. When processed, this could execute the attacker's code in the system. This attack is possible even when installing packages with the '--ignore-scripts' flag, which disables built-in script execution. In total, npm is affected by four vulnerabilities (CVE-2021-32804, CVE-2021-37713, CVE-2021-39134, and CVE-2021-39135) out of the seven. The first two issues pertain to the tar package, while the other two involve the @npmcli/arborist package.
The most dangerous vulnerability, CVE-2021-32804, arises because, when sanitizing specified absolute paths in the tar archive, repeated '/' characters are incorrectly handled—only the first character is removed, while the others remain. For example, the path '/home/user/.bashrc' will be transformed into 'home/user/.bashrc', while the path '//home/user/.bashrc' will become '/home/user/.bashrc'. The second vulnerability, CVE-2021-37713, occurs only on the Windows platform and is related to the improper sanitization of relative paths that include an undelimited drive symbol ('C:some\path') and a sequence to return to the previous directory ('C:../foo').
The vulnerabilities CVE-2021-39134 and CVE-2021-39135 are specific to the @npmcli/arborist module. The first issue only manifests on case-insensitive file systems (macOS and Windows) and allows writing files to arbitrary parts of the file system by specifying two dependencies: ‘"foo": "file:/some/path"‘ and ‘FOO: "file:foo.tgz"‘, whose processing results in deleting the contents of the directory /some/path and writing the contents of foo.tgz into it. The second issue allows overwriting files through manipulation with symbolic links.
The vulnerabilities have been fixed in Node.js releases 12.22.6 and 14.17.6, npm CLI 6.14.15 and 7.21.0, as well as in specific releases of the tar package 4.4.19, 5.0.11, and 6.1.10. After learning about the problem through the bug bounty initiative, GitHub paid researchers $14,500 and scanned the repository's content, which did not reveal any attempts to exploit the vulnerabilities. To protect against these issues, GitHub also implemented a ban on publishing NPM packages in the repository that include symbolic links, hard links, and absolute paths.
Source: opennet.ru
