decompress npm package path traversal and setuid priv escalation CVE-2020-12269

Vulnerability Overview Title: Archive extraction can create files and links outside the target directory Description: When extracting archive files into a directory, a maliciously crafted archive can read from or write to files outside the target directory. The issue stems from flaws in the extraction logic for all supported formats (e.g., tar, tar.gz, tar.bz2, and zip) when writing parsed entries, unless redirection is configured via plugin options. Impact: Hard links and symbolic links are created without verifying their target paths. Hard links can point to any file readable by running processes, leading to file content leakage. Symbolic links can point to paths outside the output directory, effectively redirecting to another directory. Path validation uses string prefix comparison ( ); however, this logic incorrectly treats as containing , allowing entries to escape into sibling directories whose names begin with the output directory's name. File permissions are applied as , which fails to remove setuid, setgid, or sticky bits. Malicious entries can create files with setuid or setgid attributes, which is particularly critical when extraction is performed as root, such as in CI pipelines, containers, or installation scripts. Any code that extracts archives from untrusted or attacker-controlled sources is affected. Since archives often enter systems via downloads, they are frequently network-accessible. Affected Versions Affected Versions: - (npm): , - (npm): Fixed Versions: - (npm): , - (npm): No fixed version available Remediation Patch: - In versions 10.2.1 and 11.1.3, link targets are now resolved and validated to ensure they remain within the output directory. Additionally, setuid, setgid, and sticky bits are stripped. - The upstream package is unmaintained, and all versions (including 4.2.1) suffer from the same issue. Migration to 11.1.3 or higher is recommended. Workarounds: - Only extract trusted archives. - Run extraction processes as a non-root user to prevent the creation of privileged files. - After extraction, reject any symbolic links or hard links that point outside the target directory or possess unexpected permission bits. References CVE-2020-12269 CVE-2020-12270 GHSA-gq9r-5hqp-vmv9 Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2020-12269 Weaknesses: - CWE-22 - CWE-59 - CWE-732 Credit: XhimikosR (Remediation developer)

Goal Reached Thanks to every supporter — we hit 100%!

decompress npm package path traversal and setuid priv escalation CVE-2020-12269

More from this source