CVE-2020-7668: Path Traversal in github.com/unknwon/cae

Background

The package github.com/unknwon/cae is a Go package that provides functionality for working with archives, including tz and zip formats. It offers methods for creating, opening, extracting, and manipulating files within these archives. However, a vulnerability has been discovered in the package that allows for path traversal attacks. This means that an attacker can manipulate file paths in a way that allows them to write or overwrite files outside of the intended target directory.

Vulnerability Detail

The vulnerability in github.com/unknwon/cae is due to improper path sanitization. When handling archives that contain relative file paths, the package fails to properly validate and sanitize these paths. As a result, an attacker can craft a malicious archive that includes file paths that traverse outside of the target directory. This can lead to unauthorized access, data leakage, or even remote code execution if the overwritten files are executable. The vulnerability affects versions 0.0.0 to 1.0.0 of the package.

go get github.com/unknwon/cae@v1.0.2

go get github.com/unknwon/cae@v1.0.1

Workaround

If updating to the latest version is not immediately possible, a temporary workaround is to manually validate and sanitize file paths before extracting or manipulating them. This can be done by checking if the path is within the intended target directory and rejecting any paths that attempt to traverse outside of it. Here is an example of how to implement this workaround in Go:

import (
	"github.com/unknwon/cae"
	"path/filepath"
)

func extractArchive(archivePath string, targetDir string) error {
	archive, err := cae.Open(archivePath)
	if err != nil {
		return err
	}

	for _, file := range archive.Files() {
		filePath := filepath.Join(targetDir, file.Path)
		if !isWithinTargetDir(filePath, targetDir) {
			return fmt.Errorf("Invalid file path: %s", filePath)
		}

		// Extract or manipulate the file
	}

	return nil
}

func isWithinTargetDir(filePath string, targetDir string) bool {
	absFilePath, err := filepath.Abs(filePath)
	if err != nil {
		return false
	}

	absTargetDir, err := filepath.Abs(targetDir)
	if err != nil {
		return false
	}

	return strings.HasPrefix(absFilePath, absTargetDir)
}

Conclusion

The vulnerability in github.com/unknwon/cae allows for path traversal attacks, which can lead to unauthorized access, data leakage, or remote code execution. Users of the package should update to version 1.0.1 to fix the vulnerability. If immediate updating is not possible, a temporary workaround is available. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/unknwon/cae →

FAQ