CVE-2019-10743: Path Traversal in MHolt Archiver

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

MHolt Archiver is a Go package that provides functionality for creating and extracting various archive formats. It is commonly used for compressing and decompressing files in applications. The vulnerability identified as CVE-2019-10743 affects all versions of archiver and allows an attacker to perform a Zip Slip attack. This attack takes advantage of the 'unarchive' functions in archiver by exploiting specially crafted zip archives that contain path traversal filenames. By manipulating the filenames, an attacker can break out of the target extraction directory and potentially overwrite important files, leading to arbitrary code execution.

Vulnerability Detail

The vulnerability arises from the improper handling of filenames in zip archives. When a malicious archive is processed, the filename is concatenated to the target extraction directory without proper validation. This allows an attacker to include '../' sequences in the filename, which results in traversing outside of the intended directory structure. If an executable or a configuration file is overwritten with a file containing malicious code, the vulnerability can lead to arbitrary code execution. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.5.

go get github.com/mholt/archiver@v3.1.1+incompatible

go get github.com/mholt/archiver@v3.3.2

Workaround

If updating the archiver package is not immediately possible, a temporary workaround is to implement additional validation and sanitization of filenames during the extraction process. This can be done by checking for any '../' sequences and rejecting such filenames. Here is an example code snippet in Go that demonstrates the workaround:

func extractArchive(archivePath string, targetDir string) error {
  // Open the archive
  archive, err := archiver.ByExtension(archivePath)
  if err != nil {
    return err
  }

  // Iterate over the files in the archive
  for _, file := range archive.Files() {
    // Check for path traversal filenames
    if strings.Contains(file.Name(), "../") {
      return errors.New("Invalid filename")
    }

    // Extract the file
    err := archive.Extract(file, targetDir)
    if err != nil {
      return err
    }
  }

  return nil
}

Conclusion

In conclusion, the CVE-2019-10743 vulnerability in MHolt Archiver allows for a path traversal attack through specially crafted zip archives. It is important to update to version 3.3.2 or later of the archiver package to mitigate this vulnerability. If immediate updating is not possible, implementing additional validation and sanitization of filenames can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/mholt/archiver →

FAQ