CVE-2018-1002207: Arbitrary File Write via Archive Extraction in mholt/archiver
Summary
CVE-2018-1002207: Arbitrary File Write via Archive Extraction in mholt/archiver. Affects github.com/mholt/archiver versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mholt/archiver is a Go package that provides functionality for creating and extracting various archive formats. It is commonly used in Go applications for handling file compression and decompression. However, versions of the package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 are vulnerable to a directory traversal attack, also known as 'Zip-Slip'. This vulnerability allows attackers to write to arbitrary files by exploiting a mishandling of archive entries during extraction.
Vulnerability Detail
The vulnerability arises from the mishandling of archive entries that contain a '../' (dot dot slash) sequence. By including this sequence in an archive entry, an attacker can traverse directories and write files to arbitrary locations on the file system. This can lead to unauthorized modification or disclosure of sensitive data, as well as potential code execution if the attacker is able to overwrite executable files. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.5.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
go get github.com/mholt/archiver@v2.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the mholt/archiver package is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing the paths of extracted archive entries. This can be done by checking for any '../' sequences and ensuring that the resulting path is within the intended directory. Here is an example of how this can be done in Go:
import (
"path/filepath"
"strings"
)
func sanitizePath(path string) (string, error) {
if strings.Contains(path, "../") {
return "", fmt.Errorf("Invalid path")
}
return filepath.Clean(path), nil
}
This code snippet checks if the extracted path contains any '../' sequences and returns an error if found. Otherwise, it uses the filepath.Clean function to ensure the path is valid and free of any directory traversal attempts.
Conclusion
The vulnerability in the mholt/archiver package allows for arbitrary file write through directory traversal during archive extraction. It is crucial to update to version 2.1.0 or later of the package to mitigate this vulnerability. If immediate update is not possible, implementing a temporary workaround by validating and sanitizing extracted paths can provide some protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/mholt/archiver →
FAQ
The mholt/archiver package is a Go library that provides functionality for creating and extracting various archive formats, such as ZIP, TAR, and GZIP. It is commonly used in Go applications for handling file compression and decompression.
Directory traversal, also known as path traversal, is a vulnerability that allows an attacker to access files or directories outside of the intended directory. It occurs when user input is not properly validated or sanitized, allowing malicious input to navigate to parent directories.
'Zip-Slip' is a term used to describe a specific type of directory traversal vulnerability that occurs during the extraction of ZIP archives. It refers to the ability of an attacker to write files to arbitrary locations on the file system by including '../' sequences in archive entries.
The vulnerability allows attackers to write to arbitrary files, which can lead to unauthorized modification or disclosure of sensitive data. Additionally, if the attacker is able to overwrite executable files, it could result in code execution and further compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/mholt/archiver.
