« Volver al listado

CVE-2024-12905

Estado: AplazadaAlta (7.5)—

An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.

This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Extracción de archivos tar maliciosos (AV:N, PR:N, UI:N) que permite sobrescritura de archivos fuera del directorio destino (CWE-22, CWE-59). El atacante puede modificar o crear archivos arbitrarios, escalando si alcanza directorios críticos del sistema.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Network SegmentationApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability ScanningThreat Intelligence Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Tar-fs — Tar-fsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-12905",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-12905",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-27T18:21:53.061002Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
      "affectedData": [
        {
          "repo": "https://github.com/mafintosh/tar-fs",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "1.16.4",
                  "status": "unaffected"
                }
              ],
              "version": "0.0.0",
              "lessThan": "1.16.4",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "2.1.2",
                  "status": "unaffected"
                }
              ],
              "version": "2.0.0",
              "lessThan": "2.1.2",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.0.8",
                  "status": "unaffected"
                }
              ],
              "version": "3.0.0",
              "lessThan": "3.0.8",
              "versionType": "semver"
            }
          ],
          "packageName": "tar-fs",
          "programFiles": [
            "index.js"
          ],
          "collectionURL": "https://registry.npmjs.org",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-27T17:15:53.250",
  "references": [
    {
      "url": "https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed",
      "source": "22e2d327-25fe-45d7-9f0c-dcd23b7108df"
    },
    {
      "url": "https://www.seal.security/blog/a-link-to-the-past-uncovering-a-new-vulnerability-in-tar-fs",
      "source": "22e2d327-25fe-45d7-9f0c-dcd23b7108df"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.\n\nThis issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8."
    },
    {
      "lang": "es",
      "value": "Resolución incorrecta de enlaces antes del acceso a archivos (\"Link Following\") y limitación incorrecta de una ruta a un directorio restringido (\"Path Traversal\"). Esta vulnerabilidad se produce al extraer un archivo tar manipulado con fines maliciosos, lo que puede provocar escrituras o sobrescrituras no autorizadas de archivos fuera del directorio de extracción previsto. El problema está asociado con index.js en el paquete tar-fs. Este problema afecta a tar-fs: desde la versión 0.0.0 hasta la 1.16.4, desde la versión 2.0.0 hasta la 2.1.2, desde la versión 3.0.0 hasta la 3.0.8."
    }
  ],
  "lastModified": "2026-06-17T07:00:44.367",
  "sourceIdentifier": "22e2d327-25fe-45d7-9f0c-dcd23b7108df"
}