Listen to this Post
The vulnerability in ZenML’s `PathMaterializer` class stems from an insufficient path validation mechanism during the extraction of a `data.tar.gz` archive. The `load` function utilizes `is_path_within_directory` to check if extracted file paths reside within the intended target directory. However, this check is inadequate when dealing with archive entries that are symbolic or hard links. An attacker can craft a malicious tarball containing a link that points to a critical file or directory outside the intended extraction path. When the tarball is processed, the link is followed, and the subsequent file operations are performed on the linked location, not a file within the safe directory. This allows for arbitrary file overwrite, which can be escalated to remote code execution if a system file like `/etc/passwd` or a startup script is modified.
Platform: ZenML
Version: 0.83.1
Vulnerability: Path Traversal
Severity: Moderate
date: 2025-10-05
Prediction: Patch by 2025-10-19
What Undercode Say:
Creating a malicious tarball with a symlink
ln -s /etc/passwd malicious-link
tar czf data.tar.gz malicious-link
Example of a vulnerable Python code path
from zenml.materializers.path_materializer import PathMaterializer
materializer = PathMaterializer()
materializer.load("data.tar.gz") Extracts and follows symlink
How Exploit:
Craft a tarball containing a symbolic link named ../../../../etc/passwd. When extracted by the vulnerable `PathMaterializer.load()` function, the process overwrites the system’s passwd file.
Protection from this CVE:
Update ZenML. Sanitize archive paths. Disable symlink following during extraction. Use `chroot` or sandboxing.
Impact:
Arbitrary File Overwrite
Remote Code Execution
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
