CVE-2020-28949: Multiple vulnerabilities through filename manipulation in Archive_Tar
Summary
CVE-2020-28949: Multiple vulnerabilities through filename manipulation in Archive_Tar. Affects pear/archive_tar versions < 1.4.11. Fixed in 1.4.11. How to fix ↓
Also tracked for
- drupal · Bitnami
- drupal/core · Packagist
- php-pear · Debian:11
The same CVE-2020-28949 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Archive_Tar is a package available on Packagist that provides functionality for creating and extracting tar archives in PHP applications. It is widely used in various projects for managing file archives. However, versions up to 1.4.10 of Archive_Tar are vulnerable to filename manipulation attacks, which can lead to unauthorized file overwrites. This vulnerability can be exploited by an attacker to overwrite arbitrary files on the system, potentially leading to remote code execution or unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability in Archive_Tar (CVE-2020-28949) arises from inadequate filename sanitization. While the package addresses phar attacks by sanitizing :// filenames, it fails to protect against other stream-wrapper attacks, such as file://. This oversight allows an attacker to manipulate filenames and overwrite files on the system. The impact of this vulnerability can be severe, as it enables unauthorized modification of critical files, leading to potential data breaches, system compromise, or the execution of arbitrary code.
How To Fix
Minimum fixed version
1.4.11
This is the first release that contains the fix.
composer require pear/archive_tar:1.4.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize filenames before passing them to Archive_Tar. This can be achieved by removing any potentially malicious stream-wrapper prefixes, such as file://, from the filename. Here is an example of how to sanitize a filename using PHP:
$filename = str_replace('file://', '', $filename);
Conclusion
The vulnerability in Archive_Tar (CVE-2020-28949) allows attackers to manipulate filenames and overwrite arbitrary files on the system. To mitigate this risk, it is crucial to upgrade to Archive_Tar version 1.4.11 or later. Developers should also ensure proper filename sanitization when working with user-supplied filenames. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pear/archive_tar →
FAQ
Archive_Tar is a PHP package that provides functionality for creating and extracting tar archives. It is commonly used in PHP projects for managing file archives.
The vulnerability allows an attacker to manipulate filenames and overwrite arbitrary files on the system. This can lead to unauthorized access to sensitive information, remote code execution, or compromise of the entire system.
To fix this vulnerability, it is recommended to upgrade Archive_Tar to version 1.4.11 or later. This version includes proper filename sanitization to prevent stream-wrapper attacks.
As a temporary workaround, you can manually sanitize filenames before passing them to Archive_Tar. Remove any potentially malicious stream-wrapper prefixes, such as file://, from the filename.
You can find more information about this vulnerability in the GitHub advisory: https://github.com/pear/Archive_Tar/issues/33
References
Related vulnerabilities
Recent vulnerabilities recorded for pear/archive_tar.
