PHP ext-phar PharData TAR Integer Overflow & Archive Entry Injection

Phar TAR Integer Overflow - Archive Entry Injection Vulnerability Overview Vulnerability Type: Integer Overflow leading to Archive Entry Injection Severity: Medium (CVSS 4.0/10) Description: The function parses the octal size field from the TAR header into a but lacks overflow checks. The field consists of 11 octal digits and can contain values such as , or even larger values like , without raising an error. The parser skips an incorrect number of data blocks and interprets attacker-controlled file content as the next TAR header, thereby creating forged archive entries. PharData reports and extracts these entries as if they were legitimate. Scope of Impact Affected Package: ext-phar (PHP) Affected Versions: - < 8.2.34 - < 8.3.35 - < 8.4.26 - < 8.5.11 Fixed Versions: - 8.2.34 - 8.3.35 - 8.4.26 - 8.5.11 Remediation The fix replaces the previous parsing logic ( ), which accumulated values into . The new logic rejects GNU base-256 encoding, requires the entire field to be consumed, and rejects any values exceeding . Additionally, is introduced so that all entry types carrying data can be skipped, and unsupported GNU long link records are rejected. Proof of Concept (POC) The injected header is parsed as a new entry with attacker-selected name, size, and type, appearing in the manifest alongside legitimate entries. When extracted via using , both are written, with the injected version overwriting the legitimate one. Impact Applications opening untrusted TAR archives using PharData or the stream wrapper will see a set of entries differing from the archive's actual contents, and will write the injected entries to disk. Tools that validate the archive before extraction may be tricked into believing an entry replaced the original one in the manifest; a single overflow entry can introduce an arbitrary number of additional entries. Composer's TarDownloader follows behavior using . Therefore, a tampered package can place files into that do not exist in the original archive but will be present when read by other tools.

Goal Reached Thanks to every supporter — we hit 100%!

PHP ext-phar PharData TAR Integer Overflow & Archive Entry Injection

More from this source