Medium, CVSS 6.5npmAmendedPublished
Denial of service while parsing a tar file due to lack of folders count validation
CVE-2024-28863 · GHSA-f5x3-32g6-xq36
- Affected
- npm node-tar < 6.2.1
- Fixed in
- 6.2.1· Vendor fix available
- Issue
- During some analysis today on npm's node-tar package I came across the folder creation process, Basicly if you provide node-tar with a path like this ./a/b/c/foo.txt it would create every folder and sub-folder here a, b and c until it reaches the last folder to create foo.txt, In-this case I noticed that there's no validation at all on the amount of folders being created, that said we're actually able to CPU and memory consume the system running node-tar and even crash the nodejs client within few seconds of running it using a path with too many sub-folders inside Steps To Reproduce: You can reproduce this issue by downloading the tar file I provided in the resources and using node-tar to extract it, you should get the same behavior as the video Proof Of Concept: Here's a video show-casing the exploit: Impact Denial of service by crashing the nodejs client when attempting to parse a tar archive, make it run out of heap memory and consuming server CPU and memory resources…
Recommended action: Upgrade to 6.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.