CVE-2023-37460: Arbitrary File Creation in AbstractUnArchiver
Summary
CVE-2023-37460: Arbitrary File Creation in AbstractUnArchiver. Affects org.codehaus.plexus:plexus-archiver versions < 4.8.0. Fixed in 4.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is org.codehaus.plexus:plexus-archiver, which is a component of the Maven ecosystem. It is responsible for archiving and extracting files in various formats. The vulnerability in question arises when using the AbstractUnArchiver class for extracting an archive. This vulnerability allows for arbitrary file creation and potential remote code execution.
Vulnerability Detail
The vulnerability stems from the resolveFile() function in AbstractUnArchiver. When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist, the resolveFile() function returns the symlink's source instead of its target. This allows the file extraction process to write the entry's content to the symlink's target, effectively creating the destination file and potentially leading to remote code execution. This vulnerability poses a high risk to anyone using plexus archiver to extract untrusted archives.
How To Fix
Minimum fixed version
4.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package.
Conclusion
The vulnerability in org.codehaus.plexus:plexus-archiver allows for arbitrary file creation and potential remote code execution. It is crucial to update to version 4.8.0 or later to mitigate this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.codehaus.plexus:plexus-archiver →
FAQ
The vulnerability allows for arbitrary file creation and potentially enables remote code execution. An attacker could exploit this to create files with malicious content and execute arbitrary code on the victim's system.
Anyone using plexus archiver to extract untrusted archives is vulnerable to this issue.
There are currently no known exploits for this vulnerability.
Input validation alone is not sufficient to mitigate this vulnerability. It is essential to update to the fixed version of the package.
Yes, the CVSS score for this vulnerability is 8.1 (High).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.codehaus.plexus:plexus-archiver.
