Listen to this Post
The vulnerability, CVE-2024-34070, is a classic Zip Slip attack vector within the PsiTransfer application. It originates in the archive creation endpoint (lib/endpoints.js). When a user uploads a file, the application stores the user-supplied `metadata.name` from the Tus upload protocol without any path sanitization. This filename is later used directly when the server generates a `.tar.gz` archive for download. The critical function `pack.entry({ name: info.metadata.name, … })` inserts the malicious filename, including path traversal sequences like ../../../etc/passwd, into the archive’s structure. When a victim downloads this malicious archive and extracts it using standard tools (e.g., tar -xzf), the extraction process follows the embedded path. This causes the file to be written to an unintended location outside the current directory, as the `tar` command trusts the paths within the archive. No validation occurs on either the server-side during archive creation or, necessarily, on the client-side during extraction. This allows an unauthenticated attacker to completely control the file path and its content, leading to arbitrary file write on the victim’s system where the archive is extracted.
Platform: PsiTransfer
Version: < commit bd77b74
Vulnerability: Arbitrary File Write
Severity: Critical
date: 2024-05-28
Prediction: 2024-06-11
What Undercode Say:
MALICIOUS_NAME=$(echo -n "../../../tmp/dp.txt" | base64)
curl -X POST http://TARGET:3000/files \
-H "Tus-Resumable: 1.0.0" \
-H "Upload-Length: 15" \
-H "Upload-Metadata: name ${MALICIOUS_NAME}"
curl -X PATCH "http://TARGET:3000/files/evil++<UUID>" \
-H "Tus-Resumable: 1.0.0" \
-H "Upload-Offset: 0" \
-d "MALICIOUS_CONTENT"
How Exploit:
Attacker uploads a file with a traversal filename. Server stores name unsanitized. Victim downloads bucket archive. Extraction writes file outside target directory.
Protection from this CVE:
Sanitize `metadata.name` input. Validate tar entry paths. Use extraction safety flags. Apply principle of least privilege. Update to patched version.
Impact:
Arbitrary File Write. Remote Code Execution. No Authentication Required. Social Engineering Vector. System Compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
