Critical Severity
aim
Arbitrary File Overwrite via Malicious Tarfile Extraction
A vulnerability in version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to overwrite arbitrary files on the host server. This issue was patched in a subsequent release.
Available publicly on Aug 02 2024
Threat Overview
The vulnerability arises from the use of the tarfile.extractall()
function, which can be exploited to extract files to arbitrary locations on the host server. An attacker can craft a malicious tarfile with paths that traverse directories, allowing them to overwrite critical files on the server. This can lead to unauthorized access, data corruption, or further exploitation of the server.
Attack Scenario
An attacker creates a malicious tarfile with paths designed to traverse directories and overwrite critical files. They host this tarfile on a malicious server and force the target tracking server to mount the directory containing the tarfile. By manipulating the repo.path
and run_hash
values, the attacker can trigger the extraction of the tarfile, resulting in the overwriting of files on the target server.
Who is affected
Any server running version 3.19.3 of the software that uses the tarfile.extractall()
function to handle tarfile extraction is affected. This includes servers that allow external mounting of directories and extraction of tarfiles from untrusted sources.
Technical Report
Want more out of Sightline?
Sightline offers even more for premium customers
Go Premium
We have - related security advisories that are available with Sightline Premium.