Listen to this Post
The vulnerability exists in the `extractPackageTarball` function. When processing a package tarball, the function uses `path.Clean` on file header names extracted from the archive. However, `path.Clean` only normalizes paths (removing `..` and `.` components) but does not prevent extraction if the resulting path is absolute (starting with /). A malicious tar archive containing a file with a header name like `”/../../../etc/esm.sh/config.json”` would have this path “cleaned” to /etc/esm.sh/config.json. The function then joins this absolute path with the intended extraction directory, but the absolute path takes precedence, leading to an arbitrary file write anywhere the process has write permissions on the filesystem.
DailyCVE Form:
Platform: esm.sh
Version: pre-commit
Vulnerability: Path Traversal
Severity: High
date: 2024-10-30
Prediction: Patch Q4 2024
What Undercode Say:
Analytics:
Create a malicious tarball for testing tar -czf malicious.tar.gz --absolute-names /../../../bad/file.txt
// Code snippet from the vulnerable function
func extractPackageTarball(installDir, pkgName string, r io.Reader) error {
// ... decompression setup ...
for {
header, err := tr.Next()
if err == io.EOF {
break
}
// Vulnerable cleaning: does not strip leading '/'
cleanName := path.Clean(header.Name)
targetPath := filepath.Join(installDir, pkgName, cleanName) // Absolute path bypasses join
// ... file writing logic ...
}
}
How Exploit:
- Craft a tar.gz archive containing a file with an absolute path header (e.g.,
Name: "/../../../path/to/target"). - Upload or serve this archive as a package to the vulnerable esm.sh instance.
- The extraction process writes the file to the absolute path, overwriting critical files like configuration or cached packages.
Protection from this CVE:
- Use `filepath.IsLocal` (Go 1.23+) or manually check for path separators and clean with `filepath.Clean` within a chroot/jail.
- Validate that the cleaned path is within the intended target directory by checking `strings.HasPrefix` after using `filepath.Rel` or
filepath.Abs. - Reject tar entries where `header.Name` is an absolute path.
Impact:
- Arbitrary File Write
- Configuration Overwrite
- Cache Poisoning
- Potential Server RCE
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
