CVE-2023-46122: 
Java vulnerability analysis and mitigation

CVE-2023-46122 affects sbt (Simple Build Tool), a build tool for Scala, Java, and other languages. The vulnerability was discovered in October 2023 and involves a path traversal issue in the IO.unzip functionality. The vulnerability affects all versions from 1.0.0 up to (excluding) 1.9.7 (NVD, GitHub Advisory).

The vulnerability exists in the IO.unzip function which fails to properly validate file paths during archive extraction. When processing a specially crafted zip or JAR file, the function allows writing files to arbitrary locations outside the target directory through path traversal. The vulnerability is tracked as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has received a CVSS v3.1 base score of 7.1 HIGH from NIST NVD (NVD).

If exploited, this vulnerability could allow an attacker to write files to arbitrary locations on the system. For example, an attacker could potentially overwrite sensitive files like /root/.ssh/authorized_keys. The vulnerability affects both direct usage of IO.unzip in custom tasks and internal sbt functionality like pullRemoteCache task and Resolvers.remote (GitHub Advisory).

The vulnerability has been patched in sbt version 1.9.7. The fix implements proper path validation during archive extraction to prevent directory traversal. As a workaround, users who cannot immediately update can use alternative libraries for zip file extraction (GitHub Advisory).