CVE-2018-1000888: Archive_Tar Potential Remote Code Execution
Summary
CVE-2018-1000888: Archive_Tar contains Potential RCE if filename starts with phar://. Affects pear/archive_tar versions < 1.4.4. Fixed in 1.4.4. How to fix ↓
Also tracked for
- php-pear · Debian:11
The same CVE-2018-1000888 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Archive_Tar is a package available on Packagist that provides functionality for creating and extracting tar archives in PHP. It is commonly used in PHP applications to handle file compression and decompression. However, versions 1.4.3 and earlier of Archive_Tar contain a vulnerability that can lead to potential remote code execution (RCE) if a filename starts with 'phar://'. This vulnerability arises due to insecure file operations with the 'filename' parameter, allowing for object injection and arbitrary file deletion. The issue has been addressed in version 1.4.4.
Vulnerability Detail
The vulnerability in Archive_Tar version 1.4.3 and earlier lies in the handling of the 'filename' parameter in various file operations. When the 'extract' function is called without a specific prefix path, an attacker can craft a malicious tar file with a 'phar://' path to trigger unserialization. This unserialization can lead to object injection and the execution of the 'destruct' method in loaded PHP classes, including the Archive_Tar class itself. Exploiting this vulnerability can result in arbitrary file deletion, as the vulnerable code contains the command '@unlink($this->_temp_tarname)'. If a class with a useful gadget is loaded, it may even allow for remote code execution, potentially modifying or deleting files on the system.
How To Fix
Minimum fixed version
1.4.4
This is the first release that contains the fix.
composer require pear/archive_tar:1.4.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually modify the vulnerable code in the Archive_Tar package. Locate the file where the 'extract' function is defined (usually 'Archive/Tar.php') and find the line containing the command '@unlink($this->_temp_tarname)'. Comment out or remove this line to prevent arbitrary file deletion. However, please note that this is not a recommended long-term solution, and updating to the latest version is the best approach.
Conclusion
The Archive_Tar package versions 1.4.3 and earlier are vulnerable to potential remote code execution if a filename starts with 'phar://'. This can lead to arbitrary file deletion and, in some cases, remote code execution. It is crucial to update to version 1.4.4 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pear/archive_tar →
FAQ
Archive_Tar is a PHP package that provides functionality for creating and extracting tar archives. It is commonly used in PHP applications for file compression and decompression.
Versions 1.4.3 and earlier of Archive_Tar are affected by this vulnerability.
Exploiting this vulnerability can lead to arbitrary file deletion and, in some cases, remote code execution. Attackers may be able to modify or delete files on the system.
Yes, this vulnerability has been fixed in version 1.4.4 of Archive_Tar. It is recommended to update to this version or later to mitigate the issue.
You can update the Archive_Tar package by running the following command in your project's root directory:
composer update pear/archive_tar
References
Related vulnerabilities
Recent vulnerabilities recorded for pear/archive_tar.
