Rewterz Threat Advisory – Multiple Node.js Security Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2021-39176

Node.js detect-character-encoding module is vulnerable to a denial of service, caused by not release allocated memory after effective lifetime. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.

CVE-2021-37713

Node.js tar module could allow a local attacker to execute arbitrary code on the system, caused by insufficient logic on Windows systems when extracting tar files that contained a path that was not an absolute path but specified a drive letter different from the extraction target. An attacker could exploit this vulnerability to create or overwrite arbitrary files and execute arbitrary code on the system.

CVE-2021-37712

Node.js tar module could allow a local attacker to execute arbitrary code on the system, caused by an arbitrary file creation/overwrite vulnerability. By creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, an attacker could use an untrusted tar file to symlink into an arbitrary location and extract arbitrary files into that location to create or overwrite arbitrary files and execute arbitrary code on the system.

CVE-2021-37701

Node.js tar module could allow a local attacker to execute arbitrary code on the system, caused by an arbitrary file creation/overwrite vulnerability. By creating a directory, and then replacing that directory with a symlink, an attacker could use an untrusted tar file to symlink into an arbitrary location and extract arbitrary files into that location to create or overwrite arbitrary files and execute arbitrary code on the system.

CVE-2021-39135

Node.js @npmcli/arborist module could allow a local attacker to launch a symlink attack. By replacing the node_modules folder of the root project or any of its dependencies with a symbolic link, an attacker could exploit this vulnerability to write package dependencies to any arbitrary location on the file system.

CVE-2021-39134

Node.js @npmcli/arborist module could allow a local attacker to launch a symlink attack, caused by the failure of multiple dependencies to coexist within the same level in the node_modules hierarchy. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to create and overwrite arbitrary files on the system with elevated privileges.

Impact

• Denial of Service
• Code Execution
• Unauthorized Access

Affected Vendors

Node.js

Affected Products

• Node.js detect-character-encoding 0.3.0
• Node.js Node.js 12
• Node.js Node.js 14.0
• Node.js tar 4.4.0

Remediation

Upgrade to the latest version of detect-character-encoding (0.3.1 or later), available from the detect-character-encoding GIT Repository.