{"id":3131,"date":"2021-09-11T19:34:38","date_gmt":"2021-09-11T14:04:38","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=3131"},"modified":"2021-09-11T19:34:39","modified_gmt":"2021-09-11T14:04:39","slug":"github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/","title":{"rendered":"GitHub Discovers 7 Code Execution Vulnerabilities in \u2018Tar\u2019 and Npm CLI"},"content":{"rendered":"\n<p>GitHub security group has discovered some high-severity vulnerabilities in npm packages, &#8220;tar&#8221; and &#8220;@npmcli\/arborist,&#8221; used by npm CLI. The tar package collects 20 million weekly downloads on average, whereas arborist gets downloaded over 300,000 times every week.<\/p>\n\n\n\n<p>The vulnerabilities harm both Windows and Unix-based users, and if left unpatched, can be exploited by threat actors to achieve arbitrary code execution on a system installing unauthenticated npm packages.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Bug bounty hunters awarded $14,500 for ZIP slips<\/strong><\/h2>\n\n\n\n<p>Between July and August this year, security researchers and bug bounty hunters Robert Chen and Philip Papurt identified arbitrary code execution vulnerabilities in the open-source Node.js packages, tar, and @npmcli\/arborist.<\/p>\n\n\n\n<p>On discovery of these vulnerabilities, the researchers privately notified npm via one of GitHub&#8217;s bug bounty programs. On further review of the researchers&#8217; reports, the GitHub security team found some more high-severity vulnerabilities in the aforementioned packages, affecting both Windows and Unix-based systems.<\/p>\n\n\n\n<p>Node.js package tar continues a core dependency for installers that require unpack npm packages post-installation. The package is also used by thousands of other open-source projects, and as such receives roughly 20 million downloads every week. The arborist package is a core dependency relied on by npm CLI and is used to manage node_modules trees.<\/p>\n\n\n\n<p>These ZIP slip vulnerabilities pose a problem for developers installing untrusted npm packages using the npm CLI or using &#8220;tar&#8221; to extract untrusted packages. By default, npm packages are shipped as .tar.gz or .tgz files which are ZIP-like archives and as such need to be extracted by the installation tools.<\/p>\n\n\n\n<p>The tools extracting these archives should ideally assure any malicious ways within the archive don&#8217;t finish up overwriting present files, particularly the sensitive ones, on the filesystem. But, because of the vulnerabilities listed below, the npm package when extracted could overwrite arbitrary files with the privileges of the user running the npm install command:<\/p>\n\n\n\n<ul><li>CVE-2021-32803<\/li><li>CVE-2021-32804<\/li><li>CVE-2021-37701<\/li><li>CVE-2021-37712<\/li><li>CVE-2021-37713<\/li><li>CVE-2021-39134<\/li><li>CVE-2021-39135<\/li><\/ul>\n\n\n\n<p>&#8220;CVE-2021-32804, CVE-2021-37713, CVE-2021-39134, and CVE-2021-39135 specifically have a safety impact on the npm CLI while processing a malicious or untrusted npm package install,&#8221; explains Mike Hanley, Chief Security Officer at GitHub.<\/p>\n\n\n\n<p>&#8220;Some of these problems may result in arbitrary code execution, even if you are using &#8211;ignore-scripts to restrict the processing of package lifecycle scripts.&#8221;<\/p>\n\n\n\n<p>GitHub Security team thanked both Chen and Papurt for their responsible disclosure and awarded them a total bounty of $14,500 for their efforts in keeping GitHub secure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>NPM Urging Users to Fix Vulnerabilities<\/strong><\/h2>\n\n\n\n<p>Npm, owned by GitHub, is also prompting the developers to fix these vulnerabilities ASAP in a tweet:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"391\" height=\"498\" src=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/GitHub-Discovers-7-Code-Execution-Vulnerabilities-in-\u2018Tar-and-Npm-CLI-image1.png\" alt=\"GitHub-Discovers-7-Code-Execution-Vulnerabilities-in-\u2018Tar\u2019-and-Npm-CLI-image1\" class=\"wp-image-3134\" srcset=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/GitHub-Discovers-7-Code-Execution-Vulnerabilities-in-\u2018Tar-and-Npm-CLI-image1.png 391w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/GitHub-Discovers-7-Code-Execution-Vulnerabilities-in-\u2018Tar-and-Npm-CLI-image1-236x300.png 236w\" sizes=\"(max-width: 391px) 100vw, 391px\" \/><\/figure><\/div>\n\n\n\n<p>Makers should enhance their tar dependency versions to 4.4.19, 5.0.11, or 6.1.10, and upgrade @npmcli\/arborist version 2.8.2 to patch the vulnerabilities. For npm CLI, versions v6.14.15, v7.21.0, or newer contain the fix. Moreover, Node.js version 12, 14, or 16 come with the fixed tar version and can be safely upgraded to, according to GitHub.v<\/p>\n","protected":false},"excerpt":{"rendered":"<p>GitHub security group has discovered some high-severity vulnerabilities in npm packages, &#8220;tar&#8221; and &#8220;@npmcli\/arborist,&#8221; used by npm CLI. The tar package collects 20 million weekly downloads on average, whereas arborist gets downloaded over 300,000 times every week. The vulnerabilities harm both Windows and Unix-based users, and if left unpatched, can be exploited by threat actors [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":3133,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.11 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>GitHub Discovers 7 Code Execution Vulnerabilities in \u2018Tar\u2019 and Npm CLI - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GitHub Discovers 7 Code Execution Vulnerabilities in \u2018Tar\u2019 and Npm CLI - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"GitHub security group has discovered some high-severity vulnerabilities in npm packages, &#8220;tar&#8221; and &#8220;@npmcli\/arborist,&#8221; used by npm CLI. The tar package collects 20 million weekly downloads on average, whereas arborist gets downloaded over 300,000 times every week. The vulnerabilities harm both Windows and Unix-based users, and if left unpatched, can be exploited by threat actors [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-09-11T14:04:38+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-09-11T14:04:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/GitHub-Discovers-7-Code-Execution-Vulnerabilities-in-\u2018Tar-and-Npm-CLI-featured-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"GitHub Discovers 7 Code Execution Vulnerabilities in \u2018Tar\u2019 and Npm CLI\",\"datePublished\":\"2021-09-11T14:04:38+00:00\",\"dateModified\":\"2021-09-11T14:04:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/\"},\"wordCount\":491,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Vulnerabilities\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/\",\"url\":\"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/\",\"name\":\"GitHub Discovers 7 Code Execution Vulnerabilities in \u2018Tar\u2019 and Npm CLI - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2021-09-11T14:04:38+00:00\",\"dateModified\":\"2021-09-11T14:04:39+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GitHub Discovers 7 Code Execution Vulnerabilities in \u2018Tar\u2019 and Npm CLI\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"GitHub Discovers 7 Code Execution Vulnerabilities in \u2018Tar\u2019 and Npm CLI - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/","og_locale":"en_US","og_type":"article","og_title":"GitHub Discovers 7 Code Execution Vulnerabilities in \u2018Tar\u2019 and Npm CLI - Xiarch Solutions Private Limited","og_description":"GitHub security group has discovered some high-severity vulnerabilities in npm packages, &#8220;tar&#8221; and &#8220;@npmcli\/arborist,&#8221; used by npm CLI. The tar package collects 20 million weekly downloads on average, whereas arborist gets downloaded over 300,000 times every week. The vulnerabilities harm both Windows and Unix-based users, and if left unpatched, can be exploited by threat actors [&hellip;]","og_url":"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2021-09-11T14:04:38+00:00","article_modified_time":"2021-09-11T14:04:39+00:00","og_image":[{"width":1000,"height":525,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/GitHub-Discovers-7-Code-Execution-Vulnerabilities-in-\u2018Tar-and-Npm-CLI-featured-image.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"GitHub Discovers 7 Code Execution Vulnerabilities in \u2018Tar\u2019 and Npm CLI","datePublished":"2021-09-11T14:04:38+00:00","dateModified":"2021-09-11T14:04:39+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/"},"wordCount":491,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Vulnerabilities"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/","url":"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/","name":"GitHub Discovers 7 Code Execution Vulnerabilities in \u2018Tar\u2019 and Npm CLI - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2021-09-11T14:04:38+00:00","dateModified":"2021-09-11T14:04:39+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/github-discovers-7-code-execution-vulnerabilities-in-tar-and-npm-cli\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"GitHub Discovers 7 Code Execution Vulnerabilities in \u2018Tar\u2019 and Npm CLI"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3131"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=3131"}],"version-history":[{"count":1,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3131\/revisions"}],"predecessor-version":[{"id":3135,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3131\/revisions\/3135"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/3133"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=3131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=3131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=3131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}