CVE-2023-37460 Plexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiver
Attackers can create arbitrary files and potentially execute code by exploiting symlink handling during archive extraction in Plexus Archiver.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-37460?
CVE-2023-37460 is a high-severity path traversal vulnerability in codehaus-plexus plexus-archiver, published on 25 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remote code execution. When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the `resolveFile()` function will return the symlink's source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later `Files.newOutputStream()`, that follows symlinks by default, will actually write the entry's content to the symlink's target. Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. Version 4.8.0 contains a patch for this issue.
Which versions are affected by CVE-2023-37460?
2 open source packages ship an affected version, including org.codehaus.plexus:plexus-archiver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.codehaus.plexus:plexus-archiver Maven | All versions | 4.8.0 |
org.codehaus.plexus:plexus-archiver Maven | All versions | 4.8.0 |
Linux distribution packages (38)
plexus-archiver Red Hat:enterprise_linux:7::client | All versions | 0:2.4.2-6.el7_9 |
plexus-archiver-javadoc Red Hat:enterprise_linux:7::client | All versions | 0:2.4.2-6.el7_9 |
plexus-archiver Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.2-6.el7_9 |
plexus-archiver-javadoc Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.2-6.el7_9 |
plexus-archiver Red Hat:enterprise_linux:7::server | All versions | 0:2.4.2-6.el7_9 |
plexus-archiver-javadoc Red Hat:enterprise_linux:7::server | All versions | 0:2.4.2-6.el7_9 |
plexus-archiver Red Hat:enterprise_linux:7::workstation | All versions | 0:2.4.2-6.el7_9 |
plexus-archiver-javadoc Red Hat:enterprise_linux:7::workstation | All versions | 0:2.4.2-6.el7_9 |
maven-archiver SUSE:Enterprise Storage 7.1 | All versions | 3.6.1-150200.3.7.3 |
maven-common-artifact-filters SUSE:Enterprise Storage 7.1 | All versions | 3.3.2-150200.3.7.3 |
maven-compiler-plugin SUSE:Enterprise Storage 7.1 | All versions | 3.11.0-150200.3.7.1 |
maven-plugin-tools SUSE:Enterprise Storage 7.1 | All versions | 3.9.0-150200.3.7.3 |
objectweb-asm SUSE:Enterprise Storage 7.1 | All versions | 9.6-150200.3.11.3 |
plexus-archiver SUSE:Enterprise Storage 7.1 | All versions | 4.8.0-150200.3.7.2 |
plexus-compiler SUSE:Enterprise Storage 7.1 | All versions | 2.14.2-150200.3.9.2 |
maven-archiver SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 3.6.1-150200.3.7.3 |
maven-common-artifact-filters SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 3.3.2-150200.3.7.3 |
maven-compiler-plugin SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 3.11.0-150200.3.7.1 |
maven-plugin-tools SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 3.9.0-150200.3.7.3 |
objectweb-asm SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 9.6-150200.3.11.3 |
plexus-archiver SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 4.8.0-150200.3.7.2 |
plexus-compiler SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 2.14.2-150200.3.9.2 |
maven-archiver SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 3.6.1-150200.3.7.3 |
maven-common-artifact-filters SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 3.3.2-150200.3.7.3 |
maven-compiler-plugin SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 3.11.0-150200.3.7.1 |
maven-plugin-tools SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 3.9.0-150200.3.7.3 |
objectweb-asm SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 9.6-150200.3.11.3 |
plexus-archiver SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 4.8.0-150200.3.7.2 |
plexus-compiler SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 2.14.2-150200.3.9.2 |
maven-archiver SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 3.6.1-150200.3.7.3 |
maven-common-artifact-filters SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 3.3.2-150200.3.7.3 |
maven-compiler-plugin SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 3.11.0-150200.3.7.1 |
maven-plugin-tools SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 3.9.0-150200.3.7.3 |
objectweb-asm SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 9.6-150200.3.11.3 |
plexus-archiver SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 4.8.0-150200.3.7.2 |
plexus-compiler SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 2.14.2-150200.3.9.2 |
maven-archiver SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 3.6.1-150200.3.7.3 |
maven-common-artifact-filters SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 3.3.2-150200.3.7.3 |
Products include Codehaus-Plexus Plexus-Archiver.
How do I fix CVE-2023-37460?
Upgrade org.codehaus.plexus:plexus-archiver to 4.8.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-37460 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37460 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in codehaus-plexus plexus-archiver
Sources
Also known as AZL-27645, AZL-34813, GHSA-wh3p-fphp-9h2m, OESA-2025-1670, OESA-2025-1671, OESA-2025-1859 and 7 more.