Vulnerability DatabaseCVE-2020-7669

CVE-2020-7669:
vulnerability analysis and mitigation

Overview

The vulnerability (CVE-2020-7669) affects all versions of the package github.com/u-root/u-root/pkg/tarutil. The package is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction, which could allow attackers to write files outside of the intended directory (Snyk).

Technical details

The vulnerability occurs when a specially crafted tar archive containing path traversal filenames (using '../' sequences) is processed. When the filename is concatenated with the target extraction directory, the final path can end up outside of the target folder. This can be exploited using both leading and non-leading relative path traversal attacks (Snyk).

Impact

If successfully exploited, this vulnerability allows attackers to write files to arbitrary locations outside the intended directory. If an executable or configuration file is overwritten with malicious code, this could potentially lead to arbitrary code execution (Snyk).

Exploitability

The vulnerability has a proof-of-concept exploit available. It can be triggered by creating a tar archive that includes files with filepaths using leading or non-leading '../' sequences. The EPSS score indicates a 0.13% (50th percentile) probability of exploitation in the wild (Snyk).

Mitigation and workarounds

The recommended mitigation is to upgrade github.com/u-root/u-root/pkg/tarutil to version 0.9.0 or higher. The fix involves modifying the path handling to prevent directory traversal by using filepath.Join with a root path (Snyk, GitHub PR).