CVE-2020-7664: Path traversal in github.com/unknwon/cae
Summary
CVE-2020-7664: Path traversal in github.com/unknwon/cae. Affects github.com/unknwon/cae versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/unknwon/cae package is a Go library that provides functionality for working with zip archives. It includes features for creating, opening, extracting, and manipulating zip files. The package is widely used in various Go projects for handling zip archives.
Vulnerability Detail
The vulnerability (CVE-2020-7664) in github.com/unknwon/cae is a path traversal issue. The ExtractTo function in the package does not securely escape file paths in zip archives, allowing an attacker to include leading or non-leading ".." in file paths. This can lead to unauthorized access or modification of files system-wide. An attacker could potentially add or replace files on the system, leading to various security risks and potential compromise of sensitive data.
How To Fix
Minimum fixed version
1.0.1
This is the first release that contains the fix.
go get github.com/unknwon/cae@v1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can implement their own file path validation and sanitization mechanisms when working with zip archives to mitigate the risk of path traversal attacks.
Conclusion
The vulnerability (CVE-2020-7664) in github.com/unknwon/cae exposes the package to path traversal attacks, allowing unauthorized access or modification of files system-wide. To mitigate this risk, it is crucial to update to version 1.0.1 or later of the package and ensure that all dependencies are also updated. Developers should also follow best practices for secure file handling and implement file path validation and sanitization mechanisms. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/unknwon/cae →
FAQ
The vulnerability allows an attacker to perform path traversal attacks, potentially leading to unauthorized access or modification of files system-wide.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your Gopkg.lock file and provides real-time alerts for open-source vulnerabilities in your software.
There are no known public exploits for this vulnerability at the moment. However, it is important to update to the latest version of the github.com/unknwon/cae package to mitigate the risk.
Yes, a fix is available in version 1.0.1 or later of the github.com/unknwon/cae package. It includes secure escaping of file paths in zip archives to prevent path traversal attacks.
If your application is affected by this vulnerability, you should update to the latest version of the github.com/unknwon/cae package and ensure that all dependencies are also updated. Additionally, you can follow best practices for secure file handling and implement file path validation and sanitization mechanisms.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/unknwon/cae.
