CVE-2018-1002200: Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver
Summary
CVE-2018-1002200: Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver. Affects org.codehaus.plexus:plexus-archiver versions < 3.6.0. Fixed in 3.6.0. How to fix ↓
Also tracked for
- plexus-archiver · Debian:11
The same CVE-2018-1002200 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The plexus-archiver package is a component of the Maven ecosystem. It provides functionality for creating and extracting archive files. It is commonly used in Java projects to package and distribute software. However, versions of plexus-archiver prior to 3.6.0 are vulnerable to a directory traversal attack, also known as 'Zip-Slip'. This vulnerability allows attackers to write to arbitrary files by exploiting a mishandling of archive entries during extraction.
Vulnerability Detail
The vulnerability in plexus-archiver arises from improper limitation of a pathname to a restricted directory. Attackers can exploit this vulnerability by including a '../' (dot dot slash) sequence in an archive entry. When the archive is extracted, the '../' sequence is not properly handled, allowing the attacker to traverse directories and write to arbitrary files. This can lead to unauthorized modification of files, potential data loss, or even remote code execution.
How To Fix
Minimum fixed version
3.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of plexus-archiver to mitigate the risk of exploitation.
Conclusion
The vulnerability in plexus-archiver prior to version 3.6.0 allows for directory traversal, enabling attackers to write to arbitrary files. To mitigate this risk, it is crucial to upgrade to the fixed version of plexus-archiver. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.codehaus.plexus:plexus-archiver →
FAQ
plexus-archiver is a component of the Maven ecosystem that provides functionality for creating and extracting archive files.
Directory traversal is a vulnerability that allows an attacker to access files and directories outside of the intended scope. In this case, it allows the attacker to write to arbitrary files by exploiting a mishandling of archive entries.
'Zip-Slip' is a term used to describe the directory traversal vulnerability in archive extraction libraries, where an attacker can exploit the mishandling of archive entries to write to arbitrary files.
The vulnerability can lead to unauthorized modification of files, potential data loss, or even remote code execution, depending on the attacker's capabilities and the context in which the vulnerable package is used.
To fix this vulnerability, update the plexus-archiver package in your Maven project to version 3.6.0 or later. Modify the dependency in your pom.xml file to use the latest version of plexus-archiver.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.codehaus.plexus:plexus-archiver.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
