Vulnerability DatabaseCVE-2020-7665

CVE-2020-7665:
vulnerability analysis and mitigation

Overview

The vulnerability CVE-2020-7665 affects all versions of the package github.com/u-root/u-root/pkg/uzip prior to version 0.9.0. The vulnerability was discovered and disclosed on September 1, 2020, by Georgios Gkitsas of the Snyk Security Team. The package is vulnerable to both leading and non-leading relative path traversal attacks during zip file extraction (Snyk Advisory).

Technical details

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) with a CVSS v3.1 base score of 7.5 (HIGH). The attack vector is network-based, with low attack complexity, requiring no privileges or user interaction. The vulnerability allows for path traversal attacks through specially crafted zip archives, where malicious filenames containing '../' patterns can be used to write files outside the intended extraction directory (NVD Database).

Impact

When exploited, this vulnerability can lead to arbitrary file writes outside the target extraction directory. An attacker can create a specially crafted zip archive containing files with traversal paths (e.g., '../../file.exe'), which when extracted, could overwrite executables or configuration files outside the intended directory. This could potentially lead to arbitrary code execution if malicious files are written to sensitive locations (Snyk Advisory).

Exploitability

The vulnerability is considered highly exploitable with proof-of-concept code available. The exploit can be triggered using a specially crafted zip archive containing path traversal filenames. For example, a zip archive could contain a file path like '../../../../../../root/.ssh/authorized_keys' to potentially overwrite SSH authentication files (Snyk Advisory).

Mitigation and workarounds

The recommended mitigation is to upgrade github.com/u-root/u-root/pkg/uzip to version 0.9.0 or higher. The fix involves modifying the path joining logic to use filepath.Join(base, filepath.Join('/', file)) instead of filepath.Join(base, file), which prevents path traversal by properly handling '..' in file paths (GitHub PR).