CVE-2022-25842 Arbitrary File Write via Archive Extraction (Zip Slip)
Attackers can achieve remote code execution by exploiting a Zip Slip vulnerability in the Alibaba One Java Agent plugin to overwrite executable files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-25842?
CVE-2022-25842 is a medium-severity path traversal vulnerability in com.alibaba.oneagent:one-java-agent-plugin, published on 1 May 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.
Weakness: CWE-22
Which versions are affected by CVE-2022-25842?
2 open source packages ship an affected version, including com.alibaba.oneagent:one-java-agent-plugin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.alibaba.oneagent:one-java-agent-plugin Maven | All versions | 0.0.2 |
com.alibaba.oneagent:one-java-agent-plugin Maven | All versions | 0.0.2 |
Products include Alibabagroup One-Java-Agent.
How do I fix CVE-2022-25842?
Upgrade com.alibaba.oneagent:one-java-agent-plugin to 0.0.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-25842 being exploited?
There is no known exploitation of CVE-2022-25842 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-9hr3-j9mc-xmq2, SNYK-JAVA-COMALIBABAONEAGENT-2407874.