Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2022-03042

Опубликовано: 31 авг. 2021
Источник: fstec
CVSS3: 7.4
CVSS2: 6.3
EPSS Низкий

Описание

Уязвимость модуля Node-tar библиотеки Node.js связана с недостаточной проверкой имени пути к каталогу с ограниченным доступом. Эксплуатация уязвимости может позволить нарушителю записывать произвольные файлы или выполнить произвольный код

Вендор

Oracle Corp.
Node.js Foundation
IBM Corp.
Siemens AG

Наименование ПО

GraalVM Enterprise Edition
node-tar
IBM Cloud Private
SINEC INS

Версия ПО

20.3.3 (GraalVM Enterprise Edition)
21.2.0 (GraalVM Enterprise Edition)
от 6.1.0 до 6.1.9 (node-tar)
от 5.0.0 до 5.0.10 (node-tar)
до 4.4.18 (node-tar)
3.2.1 (IBM Cloud Private)
3.2.2 (IBM Cloud Private)
до 1.0.1.1 (SINEC INS)

Тип ПО

Прикладное ПО информационных систем
Сетевое программное средство
Сетевое средство

Операционные системы и аппаратные платформы

Microsoft Corp Windows -

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 6,3)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 7,4)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для Node-tar:
https://www.npmjs.com/package/tar
https://github.com/npm/node-tar/tags
https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh
Для программных продуктов IBM:
https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-affect-ibm-cloud-private-node-js-cve-2021-37713/
Для программных продуктов Oracle Corp.:
https://www.oracle.com/security-alerts/cpuoct2021.html
Для SINEC INS:
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 69%
0.00606
Низкий

7.4 High

CVSS3

6.3 Medium

CVSS2

Связанные уязвимости

CVSS3: 8.2
ubuntu
больше 4 лет назад

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\path`. If the drive letter does not match the extraction target, for example `D:\extraction\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target direc...

CVSS3: 8.2
redhat
больше 4 лет назад

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\path`. If the drive letter does not match the extraction target, for example `D:\extraction\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target direc...

CVSS3: 8.2
nvd
больше 4 лет назад

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\path`. If the drive letter does not match the extraction target, for example `D:\extraction\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target director

CVSS3: 8.2
debian
больше 4 лет назад

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, a ...

CVSS3: 8.2
github
больше 4 лет назад

Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization

EPSS

Процентиль: 69%
0.00606
Низкий

7.4 High

CVSS3

6.3 Medium

CVSS2