PT-2019-10267 · Npm · Tar-Fs

Max · Published 2019-04-30 · Updated 2019-05-03 · CVE-2018-20835

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: tar-fs versions prior to 1.16.2

Description: A vulnerability exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink, allowing an Arbitrary File Overwrite issue. This occurs because the plain file content replaces the existing file content.

Recommendations: For versions prior to 1.16.2, update to version 1.16.2 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-20835

GHSA-X2MC-8FGJ-3WMR

Affected Products

Tar-Fs

References · 6

• 🔥 https://hackerone.com/reports/344595 · Exploit
• https://github.com/mafintosh/tar-fs/commit/06672828e6fa29ac8551b1b6f36c852a9a3c58a2 · Patch
• https://github.com/mafintosh/tar-fs/compare/d590fc7...a35ce2f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-20835 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20835 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x2mc-8fgj-3wmr · Vendor Advisory