6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-28863

CVE-2024-28863: Denial of service while parsing a tar file due to lack of folders count validation

Description:

During some analysis today on npm's node-tar package I came across the folder creation process, Basicly if you provide node-tar with a path like this ./a/b/c/foo.txt it would create every folder and sub-folder here a, b and c until it reaches the last folder to create foo.txt, In-this case I noticed that there's no validation at all on the amount of folders being created, that said we're actually able to CPU and memory consume the system running node-tar and even crash the nodejs client within few seconds of running it using a path with too many sub-folders inside

Steps To Reproduce:

You can reproduce this issue by downloading the tar file I provided in the resources and using node-tar to extract it, you should get the same behavior as the video

Proof Of Concept:

Here's a video show-casing the exploit:

Miggo Vulnerability Database

→

CVE-2024-28863

CVE-2024-28863:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
node-tar	npm	< 6.2.1	6.2.1
tar	npm	< 6.2.1	6.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2024-28863) in the node-tar package allows for a denial of service due to the lack of validation on the number of nested folders (path depth) when parsing a tar file. The provided commit fe8cd57da5686f8695415414bda49206a545f7f7 addresses this.

The analysis of the patch in lib/unpack.js reveals the following:

A maxDepth option and a DEFAULT_MAX_DEPTH constant are introduced.
The Unpack class constructor is modified to initialize a this.maxDepth property based on the provided options or the default value. This function was vulnerable because, in its prior state, it did not establish any depth limitation, allowing the subsequent processes to attempt creating an unbounded number of directories.
The [CHECKPATH] method (a symbol-keyed method on Unpack.prototype) is modified to split the entry path into parts and check if parts.length exceeds this.maxDepth. If it does, a warning is emitted, and the method returns false, preventing the extraction of that entry. This function was vulnerable as it previously lacked this depth check, thereby permitting excessively deep paths to be processed.
The UnpackSync class extends Unpack. Its constructor calls super(opt), meaning it inherits the maxDepth initialization (or lack thereof in the vulnerable version) from the Unpack constructor. Thus, it was vulnerable for the same reasons.
UnpackSync also inherits the [CHECKPATH] method from Unpack because it does not override it. Therefore, it was vulnerable through the inherited [CHECKPATH] method's lack of depth validation.

Therefore, the vulnerable functions are the constructors of Unpack and UnpackSync (as they previously did not establish controls for maximum path depth) and their respective [CHECKPATH] methods (as they previously did not perform the depth validation, allowing the processing of excessively deep paths leading to resource exhaustion). These functions are directly involved in processing tar entry paths and were modified or affected by the patch to introduce the necessary depth validation logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.