CVE-2019-10743 Path Traversal in MHolt Archiver
Attackers can exploit path traversal in archiver's unarchive functions to overwrite files outside the target directory, potentially leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-10743?
CVE-2019-10743 is a medium-severity path traversal vulnerability in archiver, published on 28 Oct 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
All versions of archiver allow attacker to perform a Zip Slip attack via the "unarchive" functions. It is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a "../../file.exe" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.
Weakness: CWE-22
Which versions are affected by CVE-2019-10743?
2 open source packages ship an affected version, including github.com/mholt/archiver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/mholt/archiver Go | From 3.0.0 | 3.3.2 |
github.com/mholt/archiver Go | From 3.0.0 | 3.3.2 |
Products include Archiver Project Archiver.
How do I fix CVE-2019-10743?
Upgrade github.com/mholt/archiver to 3.3.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-10743 being exploited?
There is no known exploitation of CVE-2019-10743 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in archiver
Sources
Also known as GHSA-h74j-692g-48mq.