CVE-2021-32803 : Security Advisory and Response

A detailed overview of CVE-2021-32803 highlighting the vulnerability in the npm package "tar".

Understanding CVE-2021-32803

In this section, we will dive deeper into the impact, technical details, and mitigation strategies related to CVE-2021-32803.

What is CVE-2021-32803?

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. This vulnerability allowed untrusted tar files to symlink into arbitrary locations, potentially leading to arbitrary file creation and overwrite.

The Impact of CVE-2021-32803

The CVSS v3.1 base score for this vulnerability is 8.2, categorizing it as a HIGH severity issue. With low attack complexity and local attack vector, this vulnerability could result in high confidentiality and integrity impact without requiring any special privileges.

Technical Details of CVE-2021-32803

Let's explore the specific technical aspects of the vulnerability.

Vulnerability Description

The vulnerability arose due to insufficient symlink protection in the

node-tar

package, allowing malicious users to abuse the directory cache to perform arbitrary file creation and overwrite operations.

Affected Systems and Versions

The impacted versions include < 3.2.3, >= 4.0.0 and < 4.4.15, >= 5.0.0 and < 5.0.7, and >= 6.0.0 and < 6.1.2 of the npm package "tar".

Exploitation Mechanism

Malicious actors could create a symlink after a directory was initially created, bypassing symlink checks on directories and enabling them to extract arbitrary files into unauthorized locations.

Mitigation and Prevention

Discover the steps to mitigate the CVE-2021-32803 vulnerability and secure your systems.

Immediate Steps to Take

It is recommended to update the affected npm package "tar" to versions 6.1.2, 5.0.7, 4.4.15, or 3.2.3 to address this vulnerability.

Long-Term Security Practices

Keep your software dependencies up to date and implement secure coding practices to prevent similar vulnerabilities in the future.

Patching and Updates

Regularly monitor security advisories and apply patches promptly to mitigate the risk of exploitation.