Listen to this Post
The vulnerability exists in the deprecated legacy TUF client within pkg/tuf/client.go. When caching target files, the client constructs a filesystem path by directly concatenating a user-controlled `targetName` from signed metadata with a base cache directory using simple string joining. It fails to validate if the resulting absolute path remains confined within the intended cache boundary. An attacker controlling a malicious TUF repository can craft metadata with a `targetName` containing path traversal sequences like ../../../etc/passwd. When the client processes this, it blindly follows the constructed path, leading to arbitrary file write or overwrite at any location accessible by the process’s permissions, effectively a path traversal attack originating from within the cache directory.
Platform: Legacy Sigstore TUF Client
Version: Deprecated Implementation
Vulnerability: Path Traversal
Severity: Critical
Date: 2026-01-23
Prediction: Already Addressed (Migrate)
What Undercode Say:
Check if caching is enabled (vulnerable state) echo $SIGSTORE_NO_CACHE Disable the vulnerable disk caching export SIGSTORE_NO_CACHE=true Example vulnerable path construction logic (conceptual) baseDir := "/var/cache/sigstore" targetName := "../../../etc/passwd" From malicious metadata filePath := filepath.Join(baseDir, targetName) // Result: /etc/passwd - Outside the cache!
How Exploit:
A malicious TUF repository provides signed metadata containing a target file name with directory traversal sequences (../). The legacy client downloads and writes this file to disk. The constructed path escapes the cache base directory, overwriting critical system or application files wherever the process has write access, potentially leading to complete system compromise.
Protection from this CVE:
- Set `SIGSTORE_NO_CACHE=true` environment variable to disable disk caching in the legacy client.
- Immediately migrate to the new, non-affected `sigstore/sigstore-go` TUF implementation.
- Upgrade `sigstore/sigstore` to the latest version if unable to migrate immediately.
Impact:
Arbitrary file overwrite, leading to data destruction, privilege escalation, or denial of service, limited only by the compromised process’s system permissions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
