CVE-2021-37712
📋 TL;DR
This vulnerability in the npm tar package allows attackers to bypass symlink checks by exploiting Unicode normalization and Windows short path behavior. It enables arbitrary file creation/overwrite and potentially arbitrary code execution when processing malicious tar archives. Anyone using vulnerable versions of node-tar to extract untrusted tar files is affected.
💻 Affected Systems
- npm tar package (node-tar)
📦 What is this software?
Graalvm by Oracle
Graalvm by Oracle
Sinec Infrastructure Network Services by Siemens
View all CVEs affecting Sinec Infrastructure Network Services →
Tar by Npmjs
Tar by Npmjs
Tar by Npmjs
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Arbitrary file overwrite allowing privilege escalation, data corruption, or persistence mechanisms.
If Mitigated
Limited impact if only trusted tar files are processed with proper file system permissions.
🎯 Exploit Status
Exploitation requires crafting a malicious tar file with specific Unicode and path characteristics. Public proof-of-concept exists in advisory references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.18, 5.0.10, or 6.1.9 depending on major version
Vendor Advisory: https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p
Restart Required: No
Instructions:
1. Identify tar package version: npm list tar. 2. Update to patched version: npm update tar@latest. 3. For v3 users: Migrate to v4+ or apply workaround.
🔧 Temporary Workarounds
Validate tar files before extraction
allImplement validation logic to check tar files from untrusted sources before extraction.
Use alternative extraction libraries
allTemporarily switch to alternative tar extraction libraries while patching.
🧯 If You Can't Patch
- Restrict tar file processing to trusted sources only
- Run tar extraction in isolated containers with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check tar package version: npm list tar | grep tarCheck Version:
npm list tar | grep tarVerify Fix Applied:
Verify version is 4.4.18+, 5.0.10+, or 6.1.9+: npm list tar📡 Detection & Monitoring
Log Indicators:
- Unusual file creation in system directories
- Tar extraction errors related to symlinks or Unicode paths
Network Indicators:
- Large tar file uploads to web applications
- Unusual outbound connections after tar processing
SIEM Query:
Process execution where command contains 'tar' AND file path contains unusual Unicode characters🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p
- https://lists.debian.org/debian-lts-announce/2022/12/msg00023.html
- https://www.debian.org/security/2021/dsa-5008
- https://www.npmjs.com/package/tar
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p
- https://lists.debian.org/debian-lts-announce/2022/12/msg00023.html
- https://www.debian.org/security/2021/dsa-5008
- https://www.npmjs.com/package/tar
- https://www.oracle.com/security-alerts/cpuoct2021.html
