Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

AbstractUnArchiver extractFile has Partial Path Traversal Vulnerability #260

Closed
Fewword opened this issue Mar 17, 2023 · 1 comment · Fixed by #261
Closed

AbstractUnArchiver extractFile has Partial Path Traversal Vulnerability #260

Fewword opened this issue Mar 17, 2023 · 1 comment · Fixed by #261
Labels
enhancement

Comments

@Fewword
Copy link

Fewword commented Mar 17, 2023 •
edited
Loading

The patch file for CVE-2018-1002200 still has a vulnerability, which is a partial path traversal vulnerability.
In commit f8f4233, the extractFile function use if ( !canonicalDestPath.startsWith( canonicalDirPath ) )to check for path traversal vulnerabilities. But it still allows a malicious actor to potentially break out of the expected directory. The impact is limited to sibling directories. For example, userControlled.getCanonicalPath().startsWith("/usr/out") will allow an attacker to access a directory with a name like /usr/outnot.

Comparing paths with the java.nio.files.Path#startsWith will adequately protect againts this vulnerability.

For example: file.getCanonicalFile().toPath().startsWith(BASE_DIRECTORY) or file.getCanonicalFile().toPath().startsWith(BASE_DIRECTORY_FILE.getCanonicalFile().toPath())
plamentotev added a commit that referenced this issue Mar 19, 2023
@plamentotev
Fix path traversal vulnerability
d4f6b50 
AbstractUnArchiver#extractFile uses String#startsWith to verify
whether the target file is located inside the destination directory.
This check gives false negative for cases such as /opt/directory and
/opt/dir. /opt/directory starts with /opt/dir although it is not inside it.
This is a limited  path traversal vulnerability.

Fixes: #260
@plamentotev plamentotev mentioned this issue Mar 19, 2023
Merged
@plamentotev
Copy link
Member

Well spotted @Fewword.

Should we have some kind of security advisory or something similar opened for this?

plamentotev added a commit that referenced this issue Mar 20, 2023
@plamentotev
Fix path traversal vulnerability
8a37b7e 
AbstractUnArchiver#extractFile uses String#startsWith to verify
whether the target file is located inside the destination directory.
This check gives false negative for cases such as /opt/directory and
/opt/dir. /opt/directory starts with /opt/dir although it is not inside it.
This is a limited  path traversal vulnerability.

Fixes: #260
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix path traversal vulnerability codehaus-plexus/plexus-archiver
2 participants
@plamentotev @Fewword