CVE-2021-32803: Tar (node-tar) Path Traversal Vulnerability

CVE-2021-32803 Overview

CVE-2021-32803 is a symlink attack vulnerability in the npm package tar (aka node-tar) that allows arbitrary file creation and overwrite through insufficient symlink protection. The vulnerability exists in versions prior to 6.1.2, 5.0.7, 4.4.15, and 3.2.3. An attacker can craft a malicious tar archive that bypasses the library's symlink security checks, enabling them to write files to arbitrary locations on the filesystem.

The node-tar library is designed to prevent file extraction to locations that would be modified by symbolic links. However, a race condition in the directory caching mechanism allows attackers to first create a directory, then replace it with a symlink, effectively bypassing all symlink validation checks. This enables untrusted tar files to escape their intended extraction directory and write arbitrary content anywhere the process has write access.

Critical Impact

Attackers can achieve arbitrary file creation and overwrite on systems processing untrusted tar archives, potentially leading to code execution, configuration tampering, or denial of service.

Affected Products

• Tar Project node-tar (versions before 6.1.2, 5.0.7, 4.4.15, and 3.2.3)
• Oracle GraalVM Enterprise Edition (versions 20.3.3 and 21.2.0)
• Siemens SINEC Infrastructure Network Services

Discovery Timeline

• 2021-08-03 - CVE-2021-32803 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-32803

Vulnerability Analysis

This vulnerability exploits a flaw in the directory caching logic of node-tar. The library maintains a directory cache to optimize extraction performance by avoiding redundant filesystem stat calls. When a directory is created during extraction, its path is added to this cache, and subsequent operations on that path skip the directory creation step—including the critical symlink validation checks.

The attack works by crafting a tar archive with a specific ordering of entries: first, a legitimate directory entry is included, which gets created and cached. Then, a symlink entry with the same name as the directory is included, which replaces the directory. Because the path is already in the directory cache, subsequent file extractions targeting paths under that directory bypass the symlink checks entirely, allowing the symlink to redirect writes to arbitrary filesystem locations.

This is a classic Time-of-Check Time-of-Use (TOCTOU) vulnerability combined with a cache poisoning technique. The security check happens when the directory is first created, but by the time files are extracted, the directory has been replaced with a malicious symlink.

Root Cause

The root cause is insufficient cache invalidation in the node-tar extraction logic. When a non-directory entry (such as a symlink) is about to be extracted to a path that exists in the directory cache, the library fails to invalidate that cache entry. This allows the symlink to be created in place of the cached directory, while the cache still indicates that path is a safe directory.

The vulnerable code path occurs in the CHECKFS2 function within lib/unpack.js, where the library checks filesystem state before extraction but trusts the directory cache without verifying that cached directories still exist as directories.

Attack Vector

The attack is network-based, requiring user interaction to process a malicious tar archive. An attacker must convince a victim to extract a specially crafted tar file using an application that depends on a vulnerable version of node-tar. Common attack scenarios include:

1. Supply chain attacks through malicious npm packages containing crafted tar files
2. Web applications that accept user-uploaded archives
3. Build systems processing third-party dependencies
4. Automated deployment pipelines extracting external artifacts

   }
 
   [CHECKFS2] (entry, done) {
+    // if we are not creating a directory, and the path is in the dirCache,
+    // then that means we are about to delete the directory we created
+    // previously, and it is no longer going to be a directory, and neither
+    // is any of its children.
+    if (entry.type !== 'Directory') {
+      for (const path of this.dirCache.keys()) {
+        if (path === entry.absolute ||
+            path.indexOf(entry.absolute + '/') === 0 ||
+            path.indexOf(entry.absolute + '\\') === 0)
+          this.dirCache.delete(path)
+      }
+    }
+
     this[MKDIR](path.dirname(entry.absolute), this.dmode, er => {
       if (er) {
         done()

Source: GitHub Commit for Node Tar

Detection Methods for CVE-2021-32803

Indicators of Compromise

• Unexpected symlinks appearing in extraction directories pointing outside the intended path
• File modifications in system directories or sensitive locations after tar extraction operations
• Application logs showing extraction of tar entries with identical directory and symlink names

Detection Strategies

• Audit npm dependency trees using npm audit or yarn audit to identify vulnerable node-tar versions
• Implement Software Composition Analysis (SCA) scanning in CI/CD pipelines to detect vulnerable dependencies
• Monitor file system operations during tar extraction for symlink creation followed by file writes through that symlink
• Review extracted tar contents for suspicious entry ordering (directory followed by same-named symlink)

Monitoring Recommendations

• Enable file integrity monitoring on critical system directories to detect unauthorized modifications
• Log and alert on tar extraction operations that create symlinks pointing outside the extraction root
• Implement runtime application self-protection (RASP) to monitor file operations in Node.js applications

How to Mitigate CVE-2021-32803

Immediate Actions Required

• Update node-tar to version 6.1.2, 5.0.7, 4.4.15, or 3.2.3 or later depending on your major version
• Run npm audit fix or yarn upgrade to automatically update vulnerable dependencies
• Review applications for any code paths that process untrusted tar archives
• For Oracle GraalVM users, apply the Oracle Critical Patch Update - October 2021
• For Siemens SINEC INS users, review Siemens Security Advisory SSA-389290

Patch Information

The vulnerability has been patched in node-tar versions 3.2.3, 4.4.15, 5.0.7, and 6.1.2. The fix ensures that when a non-directory entry is about to be extracted, any matching paths in the directory cache are invalidated. This prevents the cache from being poisoned when a directory is replaced with a symlink. Detailed patch information is available in the GitHub Security Advisory GHSA-r628-mhmh-qjhw and npm Advisory #1771.

Workarounds

• Avoid extracting tar files from untrusted sources until the patch can be applied
• Use the --no-same-owner and --no-same-permissions flags if using command-line tar as an alternative
• Implement a pre-extraction validation step to reject tar files containing both directories and symlinks with identical names
• Run tar extraction operations in isolated containers or sandboxes with restricted filesystem access

# Update node-tar to patched version
npm update tar

# Verify installed version
npm list tar

# Run security audit to detect other vulnerable packages
npm audit

# Force update to specific patched version if needed
npm install tar@6.1.2