{"uuid": "9b32b9ea-bc75-44bd-8c5e-2ba7c732fd4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2007-4559", "type": "seen", "source": "https://t.me/hacking_Attack/70246", "content": "Black Hat Ethical Hacking\nPython\u2019s Tarfile path traversal bug from 2007 still present in 350k open source repos\n\nPython\u2019s Tarfile path traversal bug from 2007 still present in 350k open source reposPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes An estimated 350,000 open source repositories are affected by a 15-year old\u00a0path traversal\u00a0vulnerability in Python\u2019s tarfile module, according to security researchers.Having \u201cstumbled across\u201d the unpatched issue while investigating an unrelated vulnerability, they initially thought the flaw was a new zero-day bug before realizing it actually dated back to 2007.\n\nOriginally designated a severity score of CVSS 6.8, CVE-2007-4559\u00a0allows attackers to gain code execution from the file-write \u201cin most cases\u201d, said Trellix researcher Kasimir Schulz in a blog post\u00a0published yesterday (September 21).\n\nSchulz explained how Trellix researchers successfully achieved this outcome against wireless protocol analyzer Universal Radio Hacker, IT infrastructure management service Polemarch, and Spyder IDE, an open-source development environment for scientific programming.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patching marathonIn a separate Trellix blog post, Douglas McKee said 61% of a sample of around 300,000 files containing the tarfile module, which makes it possible to read and write tar archives, were vulnerable to the bug.\n\nTrellix has created patches for around 11,000 projects and anticipates that a further 70,000 projects will receive a fix in the coming weeks.\n\nThe vulnerability arose \u201cfrom two or three lines of code using unsanitized tarfile.extract()\u00a0or the built-in defaults of tarfile.extractall(),\u201d explains a third Trellix blog post\u00a0by Charles McFarland. \u201cFailure to write any safety code to sanitize the members files before calling tarfile.extract()\u00a0or tarfile.extractall()\u00a0results in a directory traversal\u00a0vulnerability, enabling a bad actor access to the file system.\u201d\n\nIf an attacker adds \u2018..\u2019 with the separator for the operating system (\u2018/\u2019 or \u2018\\\u2019) into the file name, they can escape the directory the file is supposed to be extracted into. Just a warningHowever, a Python bug thread\u00a0from 2007, which has been reopened in recent days, concluded with a maintainer asserting that \u201ctarfile.py does nothing wrong, its behaviour conforms to the pax definition and pathname resolution guidelines in POSIX. There is no known or possible practical exploit\u201d.\n\nThe maintainer did add a warning to the Python\u00a0documentation, which remains in place, that urges developers to \u201cnever extract archives from untrusted sources without prior inspection\u201d.\nTrending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo\nTrending: Offensive Security Tool: fuxploider Corner casesTrellix\u2019s McKee acknowledged that there are legitimate use cases for preserving behavior that could be abused for malicious purposes. However, he said, \u201cin this instance I believe the risk outweighs the reward for accommodating a few corner cases\u201d, especially given \u201cmost\u201d third party online tutorials seemed to \u201cincorrectly demonstrate the insecure use of the tarfile module\u201d.\n\nTrellix created and open-sourced a tool to aid the research and patching process that automatically detects the vulnerability in source code by leveraging AST intermediate representation.\n\nCalled Creosote, the utility provides a means to scan closed source repositories too.\n\n\u201cThis vulnerability is incredibly easy to exploit\u201d and prevalent in the wild, making Python\u2019s tarfile module[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:22.869777Z"}