Listen to this Post
The vulnerability in astral-tokio-tar arises from two distinct flaws in path sanitization during TAR archive extraction. First, the `Entry::unpack_in_raw` API fails to properly validate file paths, allowing entries containing path traversal sequences like `../../../` to write files outside the intended destination directory. Second, a logic flaw exists in the `allow_external_symlinks` control. Even when this check is enabled (its default state), it can be bypassed using a chain of two symlinks. The first symlink points to a location inside the destination, which is permitted. The second symlink, residing at the target of the first, then points to an external location. The validation only checks the immediate target of the first symlink, not the final resolved path, allowing the combined symlink chain to escape the restricted directory. These issues enable arbitrary file write, potentially leading to code execution.
Platform: Rust Crate
Version: <=0.5.3
Vulnerability: Path Traversal
Severity: High
date: 2025
Prediction: Patch Available (0.5.4)
What Undercode Say:
find /destination -type l -ls
// Malicious archive creation pseudo-code // Entry 1: symlink "inner_link" -> "/tmp/allowed_dir" // Entry 2: symlink "allowed_dir/final_link" -> "/etc/passwd" // Exploit unpacks, follows chain, writes to /etc/passwd
How Exploit:
Malicious TAR with traversal paths or symlink chains.
Extraction bypasses directory restriction.
Achieves arbitrary file overwrite.
Protection from this CVE
Upgrade to version 0.5.4.
Disable external symlinks if possible.
Sanitize paths before extraction.
Impact:
Arbitrary file write.
Potential remote code execution.
High severity for library users.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
