Listen to this Post
The vulnerability exists in the `safe_extract()` function within guarddog/utils/archives.py. When processing a ZIP file, the function uses zip.extract(file, path=os.path.join(target_directory, file)). The `path` parameter for `zip.extract()` is intended to be the target directory, not a full path. The method automatically appends the archive member’s name (file) to this directory path. By using os.path.join(target_directory, file), the code incorrectly appends the filename twice, creating a malformed destination path (e.g., /intended/path/malicious/../../file.txt/malicious/../../file.txt). This malformed path bypasses zipfile.extract()‘s built-in path traversal sanitization, allowing a malicious archive entry with a filename like `../../../etc/passwd` to be written outside the intended extraction directory, leading to arbitrary file overwrite.
Platform: GuardDog
Version: <1.3.0
Vulnerability: Path Traversal
Severity: Critical
Date: 2024-06-27
Prediction: 2024-07-11
What Undercode Say:
guarddog pypi scan malicious-pkg
guarddog/utils/archives.py (Vulnerable Code) zip.extract(file, path=os.path.join(target_directory, file)) Patched version should be: zip.extract(file, path=target_directory)
How Exploit:
- Create malicious Python wheel containing files with traversal names (e.g.,
../../../home/user/.bashrc).
2. Upload package to PyPI.
- Trigger GuardDog scan (
guarddog pypi scan) on the malicious package. - GuardDog downloads and extracts the package, writing files to arbitrary system locations.
Protection from this CVE
Update GuardDog to version >=1.3.0. Avoid scanning untrusted packages with vulnerable versions. Use security sandboxes.
Impact:
Arbitrary File Overwrite, Remote Code Execution, Persistent Backdoor installation (SSH, cron), System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
