Fluid Attacks Database

Description

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

Impact

v3.1.0, v2.1.3, v1.16.5 and below

Patches

Has been patched in 3.1.1, 2.1.4, and 1.16.6

Workarounds

You can use the ignore option to ignore non files/directories.

  ignore (_, header) {
    // pass files & directories, ignore e.g. symlinks
    return header.type !== 'file' && header.type !== 'directory'
  }

Credit

Reported by: Mapta / BugBunny_ai

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	node-tar-fs	=2.1.1-2 \|\| =2.1.1-3 \|\| =2.1.1-4 \|\| =2.1.1-6 \|\| =2.1.3-0+deb11u1 \|\| >=0 <2.1.3-0+deb11u2	2.1.3-0+deb11u2
debian 12	node-tar-fs	=2.1.1-6 \|\| =2.1.3-0+deb12u1 \|\| >=0 <2.1.3-0+deb12u2	2.1.3-0+deb12u2
debian 13	node-tar-fs	=3.0.9+~cs2.0.4-1 \|\| >=0 <3.0.9+~cs2.0.4-1+deb13u1	3.0.9+~cs2.0.4-1+deb13u1
debian 14	node-tar-fs	=3.0.9+~cs2.0.4-1 \|\| >=0 <3.0.9+~cs2.0.4-2	3.0.9+~cs2.0.4-2
npm	tar-fs	>=3.0.0 <3.1.1 \|\| >=2.0.0 <2.1.4 \|\| >=0 <1.16.6	3.1.1, 2.1.4, 1.16.6

Aliases

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.