hopper setup.py tarfile extractall Path Traversal Vulnerability Analysis

Vulnerability Overview This vulnerability affects the extraction process in , posing risks of path traversal and symbolic link escape. An attacker can exploit by crafting a malicious tar file to write files to arbitrary paths, potentially leading to code execution or data leakage. Scope of Impact Affected Versions: All versions utilizing within . Specific Impact: An attacker can craft a malicious tar file to write files to arbitrary paths via path traversal and symbolic link escape, potentially resulting in code execution or data leakage. Remediation 1. Implement function: - Utilize PEP 706 data filters when supported by the interpreter (Python 3.12 and later). For older versions, fall back to the security measures introduced in Python 3.10.12/3.11.4. - In older versions where the keyword argument is unavailable, manually verify the resolved path of each member to ensure it resides within the target directory, performing extraction in a single step. - Reject extraction if the cache path is a symbolic link, thereby closing the pre-planted symbolic link vector across all supported Python versions. 2. Verification: - Test against crafted tar files (containing traversal members and symbolic link members) to ensure that while the original writes outside the target directory, the patched code prevents this via filtered paths and the fallback mechanism for versions prior to 3.10.12, while correctly extracting benign archives. POC Code Summary This vulnerability leverages the path traversal and symbolic link escape risks inherent in through crafted malicious tar files, potentially leading to code execution or data leakage. The remediation involves implementing a function that utilizes data filters and manual path validation to ensure secure file extraction.

Goal Reached Thanks to every supporter — we hit 100%!

hopper setup.py tarfile extractall Path Traversal Vulnerability Analysis

More from this source