Python tarfile module directory traversal vulnerability fix analysis

Vulnerability Overview This vulnerability concerns the function within the module, specifically regarding the validation of written link targets. Prior to the fix, the function used to process the link target and computed symbolic links before stripping trailing slashes. This led to two issues: 1. Created links pointed outside the target directory. 2. Link members that resolved to the target directory itself were rejected. This could allow symbolic links to replace the target directory and redirect all subsequent members. Impact Scope This vulnerability affects the security of the module when processing tar files, particularly when they contain symbolic links. An attacker can construct a specific tar file to exploit this vulnerability, achieving directory traversal attacks to access or modify files outside the target directory. Remediation The fix includes the following measures: 1. Validate Link Targets: Verify that link targets are valid before writing to disk. 2. Normalize Paths: Use to process link targets and compute symbolic links before stripping trailing slashes. 3. Reject Invalid Links: Reject link members pointing outside the target directory, as well as those resolving to the target directory itself. POC Code The following code snippet, representing the fixed version, demonstrates how link targets are validated: Summary This vulnerability has been remediated by validating link targets and normalizing paths, ensuring the security of the module when processing tar files and preventing directory traversal attacks.

Goal Reached Thanks to every supporter — we hit 100%!

Python tarfile module directory traversal vulnerability fix analysis

More from this source