Lab 346 — DropVault — Path Traversal via Tar Symlink Cache Poisoning

hackadvisor

Task: DropVault file sharing platform with archive import feature using npm tar v6.1.1 (CVE-2021-32803). Solution: Craft a tar with a directory entry followed by a same-name symlink to /root/ — cache poisoning bypasses symlink protection, scanDir traverses the symlink and registers /root/flag.txt in the database for download.