CVE-2024-0406: Archiver Path Traversal vulnerability in github.com/mholt/archiver/v3
Summary
CVE-2024-0406: Archiver Path Traversal vulnerability in github.com/mholt/archiver. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
The same CVE-2024-0406 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/mholt/archiver/v3 is a Go library that provides functionality for creating and extracting various archive formats. It is widely used in Go applications for handling file compression and decompression tasks. However, this package is vulnerable to a Path Traversal vulnerability, which can allow an attacker to access files outside of the intended directory.
Vulnerability Detail
The Archiver Path Traversal vulnerability in github.com/mholt/archiver/v3 allows an attacker to manipulate file paths during the extraction process, potentially leading to unauthorized access to sensitive files on the system. By crafting a specially crafted archive file, an attacker can traverse directories and access files outside of the intended scope. This can result in the exposure of sensitive information or the execution of arbitrary code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization techniques to prevent malicious file paths from being processed. This can include checking for absolute paths, restricting access to parent directories, and validating user-supplied input before processing it with the archiver library.
Conclusion
The Archiver Path Traversal vulnerability in github.com/mholt/archiver/v3 can pose a significant risk to applications that utilize this package for archive handling. It is crucial to update to the latest patched version and implement input validation to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/mholt/archiver →
FAQ
The Archiver Path Traversal vulnerability can allow an attacker to access sensitive files on the system, potentially leading to unauthorized disclosure of information or the execution of arbitrary code.
Yes, all versions of the github.com/mholt/archiver/v3 package are affected by this vulnerability. It is recommended to update to the latest patched version to mitigate the risk.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is important to apply the recommended fixes to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely if the affected application exposes the archiver functionality over a network or if an attacker can trick a user into opening a maliciously crafted archive file.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/mholt/archiver.
