CVE-2024-1485 Registry-support: decompress can delete files outside scope via relative paths
An attacker can trick a user into parsing a malicious devfile to delete or overwrite files outside the intended scope via path traversal in the decompression function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-1485?
CVE-2024-1485 is a high-severity path traversal vulnerability in Redhat Openshift, published on 13 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
Weakness: CWE-22
Which versions are affected by CVE-2024-1485?
3 open source packages ship an affected version, including github.com/devfile/registry-support/registry-library. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/devfile/registry-support/registry-library Go | All versions | None |
github.com/devfile/registry-support/registry-library Go | All versions | 0.0.0-20240206 |
github.com/devfile/registry-support/registry-library Go | All versions | 0.0.0-20240206 |
Products include Devfile Registry-Support, Redhat Openshift, Redhat Openshift Developer Tools and Services.
How do I fix CVE-2024-1485?
Upgrade github.com/devfile/registry-support/registry-library to 0.0.0-20240206 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-1485 being exploited?
There is no known exploitation of CVE-2024-1485 in the wild and no public exploit code.
Sources
Also known as GHSA-84xv-jfrm-h4gm, GO-2024-2576.