ghsa-8rm2-93mq-jqhc
Vulnerability from github
Published
2024-10-11 18:10
Modified
2024-10-15 19:53
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Summary
Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.
Details

Impact

A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory.

Patches

Please use version 4.0.0 or later github.com/codeclysm/extract/v4. Any previous version is affected by the bug.

Workarounds

No knows workarounds.

Backward compatibility notes about upgrading to /v4 from /v3

If you're not using the extract.Extractor.FS interface, you will not face any breaking changes and upgrading should be as simple as changing the import to /v4. This should be the case for most of the userbase.

If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added:

```go type FS interface { Link(string, string) error MkdirAll(string, os.FileMode) error OpenFile(name string, flag int, perm os.FileMode) (*os.File, error) Symlink(string, string) error

// The following methods have been added in the /v4 interface:

Remove(path string) error
Stat(name string) (os.FileInfo, error)
Chmod(name string, mode os.FileMode) error

} ```

There should be no other breaking changes in the /v4 API.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/codeclysm/extract/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/codeclysm/extract/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/codeclysm/extract"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-47877"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-61"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-11T18:10:24Z",
    "nvd_published_at": "2024-10-11T17:15:04Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nA maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory.\n\n### Patches\nPlease use version 4.0.0 or later `github.com/codeclysm/extract/v4`. Any previous version is affected by the bug.\n\n### Workarounds\nNo knows workarounds.\n\n### Backward compatibility notes about upgrading to `/v4` from `/v3`\n\nIf you\u0027re not using the `extract.Extractor.FS` interface, you will not face any breaking changes and upgrading should be as simple as changing the import to `/v4`. This should be the case for most of the userbase.\n\nIf you\u0027re using the `Extractor.FS` interface, then upgrading to `/v4` will require to implement the new methods that have been added:\n\n```go\ntype FS interface {\n    Link(string, string) error\n    MkdirAll(string, os.FileMode) error\n    OpenFile(name string, flag int, perm os.FileMode) (*os.File, error)\n    Symlink(string, string) error\n\n    // The following methods have been added in the /v4 interface:\n\n    Remove(path string) error\n    Stat(name string) (os.FileInfo, error)\n    Chmod(name string, mode os.FileMode) error\n}\n```\n\nThere should be no other breaking changes in the `/v4` API.\n",
  "id": "GHSA-8rm2-93mq-jqhc",
  "modified": "2024-10-15T19:53:17Z",
  "published": "2024-10-11T18:10:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/codeclysm/extract/security/advisories/GHSA-8rm2-93mq-jqhc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47877"
    },
    {
      "type": "WEB",
      "url": "https://github.com/codeclysm/extract/commit/4a98568021b8e289345c7f526ccbd7ed732cf286"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/codeclysm/extract"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory."
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.