CVE-2020-7666: Arbitrary File Write via Archive Extraction in github.com/u-root/u-root/pkg/cpio
Summary
CVE-2020-7666: github.com/u-root/u-root/pkg/cpio Arbitrary File Write via Archive Extraction (Zip Slip). Affects github.com/u-root/u-root/pkg/cpio versions < 7.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/u-root/u-root/pkg/cpio is a Go package that provides functionality for working with cpio archives. It is commonly used for creating, extracting, and manipulating cpio files. This package is vulnerable to leading, non-leading relative path traversal attacks and symlink-based (relative and absolute) path traversal attacks during the extraction of cpio archives.
Vulnerability Detail
The vulnerability in github.com/u-root/u-root/pkg/cpio allows an attacker to perform arbitrary file write operations by exploiting path traversal vulnerabilities during the extraction of cpio archives. By manipulating the paths within the archive, an attacker can overwrite files outside the intended extraction directory. This can lead to unauthorized modification or deletion of critical system files, potentially resulting in a complete system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the latest version to mitigate the risk.
Conclusion
The vulnerability in github.com/u-root/u-root/pkg/cpio allows for arbitrary file write operations during the extraction of cpio archives. It is crucial to update the package to the latest version (7.0.1 or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/u-root/u-root/pkg/cpio →
FAQ
This vulnerability allows an attacker to overwrite files outside the intended extraction directory, potentially leading to unauthorized modification or deletion of critical system files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file.
Yes, the CVSS score for this vulnerability is 7.5.
There are no known public exploits for this vulnerability at the time of this report.
For more information about this vulnerability, you can contact info@devnack.com.
