CVE-2018-1002200 Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver

Medium 5.5 Published 25 Jul 2018 Updated 5 Aug 2024

Attackers can write arbitrary files via directory traversal in archive extraction, potentially leading to code execution or data modification.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-1002200?

CVE-2018-1002200 is a medium-severity path traversal vulnerability in Debian Debian Linux, published on 25 Jul 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Weakness: CWE-22

Which versions are affected by CVE-2018-1002200?

2 open source packages ship an affected version, including org.codehaus.plexus:plexus-archiver. It affects 5 products.

Package	Affected	Fixed in
`org.codehaus.plexus:plexus-archiver` Maven	All versions	`3.6.0`
`org.codehaus.plexus:plexus-archiver` Maven	All versions	`3.6.0`

Linux distribution packages (14)

`plexus-archiver` Red Hat:enterprise_linux:7::client	All versions	`0:2.4.2-5.el7_5`
`plexus-archiver-javadoc` Red Hat:enterprise_linux:7::client	All versions	`0:2.4.2-5.el7_5`
`plexus-archiver` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.4.2-5.el7_5`
`plexus-archiver-javadoc` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.4.2-5.el7_5`
`plexus-archiver` Red Hat:enterprise_linux:7::server	All versions	`0:2.4.2-5.el7_5`
`plexus-archiver-javadoc` Red Hat:enterprise_linux:7::server	All versions	`0:2.4.2-5.el7_5`
`plexus-archiver` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.4.2-5.el7_5`
`plexus-archiver-javadoc` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.4.2-5.el7_5`
`rh-maven33-plexus-archiver` Red Hat:rhel_software_collections:3::el6	All versions	`0:2.4.2-5.1.el6`
`rh-maven33-plexus-archiver-javadoc` Red Hat:rhel_software_collections:3::el6	All versions	`0:2.4.2-5.1.el6`
`rh-maven33-plexus-archiver` Red Hat:rhel_software_collections:3::el7	All versions	`0:2.4.2-5.1.el7`
`rh-maven33-plexus-archiver-javadoc` Red Hat:rhel_software_collections:3::el7	All versions	`0:2.4.2-5.1.el7`
`rh-maven35-plexus-archiver` Red Hat:rhel_software_collections:3::el7	All versions	`0:3.4-4.1.el7`
`rh-maven35-plexus-archiver-javadoc` Red Hat:rhel_software_collections:3::el7	All versions	`0:3.4-4.1.el7`

Products include Codehaus-Plexus Plexus-Archiver, Debian Debian Linux, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Workstation.

How do I fix CVE-2018-1002200?

Upgrade org.codehaus.plexus:plexus-archiver to 3.6.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-1002200 being exploited?

There is no known exploitation of CVE-2018-1002200 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

CVE-2023-37460 Plexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiver High 8.1

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-1002200, DSA-4227-1, GHSA-hcxq-x77q-3469, MGASA-2019-0005, RHSA-2018:1836, RHSA-2018:1837 and 3 more.