CVE-2024-21542: luigi Arbitrary File Write via Archive Extraction (Zip Slip)
Summary
CVE-2024-21542: luigi Arbitrary File Write via Archive Extraction (Zip Slip). Affects luigi versions < 3.6.0. Fixed in 3.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
luigi is a Python package designed for building complex data pipelines. It provides a framework for defining tasks and dependencies, allowing users to manage workflows efficiently. However, prior to version 3.6.0, luigi is susceptible to a vulnerability known as Zip Slip, which can lead to arbitrary file writes during the extraction of archives.
Vulnerability Detail
The vulnerability arises from improper validation of destination file paths in the _extract_packages_archive function. This flaw allows an attacker to craft a malicious zip file that, when extracted, can overwrite arbitrary files on the system. The ramifications of this vulnerability are severe, as it can lead to unauthorized access to sensitive files, potential data loss, and system compromise. The vulnerability is classified under CWE-29, which pertains to improper validation of file paths.
How To Fix
Minimum fixed version
3.6.0
This is the first release that contains the fix.
pip install --upgrade "luigi==3.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid extracting zip files from untrusted sources or implement additional checks in their code to validate file paths before extraction. However, the best solution is to update to the patched version.
Conclusion
The luigi package is vulnerable to an arbitrary file write issue due to improper validation of file paths during archive extraction. Users are strongly advised to update to version 3.6.0 or later to mitigate this risk. For those unable to update immediately, implementing workarounds can help reduce exposure to this vulnerability.
See every vulnerability recorded for luigi →
FAQ
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include unauthorized file access, data loss, and system compromise due to arbitrary file writes.
Yes, version 3.6.0 and later of luigi are safe to use as they have patched the vulnerability.
If immediate updates are not possible, avoid extracting zip files from untrusted sources and implement additional file path validation checks.
References
Related vulnerabilities
Recent vulnerabilities recorded for luigi.
