CVE-2023-30620 Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdb
An attacker can overwrite arbitrary local files by exploiting unsafe tarball extraction in MindsDB, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-30620?
CVE-2023-30620 is a high-severity path traversal vulnerability in mindsdb, published on 21 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release `23.2.1.0 `. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-22
Which versions are affected by CVE-2023-30620?
3 open source packages ship an affected version, including mindsdb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mindsdb PyPI | All versions | 23.2.1.0 |
mindsdb PyPI | All versions | 23.2.1.0 |
mindsdb PyPI | All versions | 23.2.1.0 |
Products include Mindsdb Mindsdb.
How do I fix CVE-2023-30620?
Upgrade mindsdb to 23.2.1.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-30620 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-30620 exists.
Other vulnerabilities in mindsdb
- CVE-2024-24759 MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
- CVE-2023-50731 MindsDB has arbitrary file write in file.py
- CVE-2023-38699 MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue
- CVE-2024-45856 MindsDB Cross-site Scripting vulnerability
- CVE-2026-27483 MindsDB has Path Traversal in /api/files Leading to Remote Code Execution
Sources
Also known as GHSA-2g5w-29q9-w6hx, PYSEC-2023-27.