CVE-2024-55587 PoC — python-libarchive 安全漏洞

Source

https://github.com/CSIRTTrizna/CVE-2024-55587

Associated Vulnerability

Title:python-libarchive 安全漏洞 (CVE-2024-55587)
Description:python-libarchive是SmartFile开源的一个 Python 的 Libarchive 包装器。 python-libarchive 4.2.1版本存在安全漏洞，该漏洞源于允许在zip.py的提取中对ZipFile.extractall和ZipFile.extract进行目录遍历。

Readme

# CVE-2024-55587
This repository is proof of concept for CVE-2024-55587 vulnerability in python library libarchive.
The generate_zip file creates malicious zip that will exploit u safe extraction of files in libarchive extractall method.
The vulnerable_zip is just an exaple of vulnerable code.

File Snapshot


 [4.0K]  /data/pocs/b6cfd167f4b64c845d3ac3463c3c19238f43bb1a
├── [ 337]  generate_zip.py
├── [ 295]  README.md
└── [ 191]  vulnerable_unzip.py

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!