GNOME Bugzilla – Bug 794337
Path traversal vulnerability
Last modified: 2019-09-22 11:19:55 UTC
While dragging a specific file / map to a location to extract to, a single ./../ path traversal is possible if present in the tar file. Demo video also shows that the default tar command does not allow this. Also the extract button option for the whole of the file also does not exert this behaviour. The video and the POC tarball from the demo are added in a tarball :P (just a normal tarball this time yes) Set Severity to normal due to the fact that you still get a correct, albeit confusing, statement about overwriting files.
Created attachment 369703 [details] poc video and tarball
Does nobody care about this security issue? This issue has been open for over a month without any progress, I doubt anyone has even read it. The one level path traversal can be used for some malicious stuff. EG: You could seed a home directory with your own .ssh/authorized_keys file/map, by having a user extract a map to their home directory.
So how to fix this? Should we just ignore filenames that contains '..' ?
Ignoring the filing with path containing .. or stripping out the (..) parts of the path will both do. I would prefer ignoring the files since that more robust and less prone to error, however but stripping out the .. part seems more in-line with the current workings. (This is because a simple ../x file will just be extracted as x, but an ./../x will perform path traversal. So removing the the relative .. parts of the path will be more consistent with currenct behaviour )
Fixed ignoring the files with relative paths. (commit 57268e51e59b61c9e3125eb0f65551c7084297e2)
Has a CVE been assigned to track this vulnerability? If not, can one please be applied for https://cve.mitre.org/cve/request_id.html
Since nothing seemed to be happening CVE wise I just filed an request for an CVE-id. Fitst time I've done so, so hope it does not get stuck in bureaucratics.
Apparently getting a CVE number was not that hard: CVE-2019-16680 has been issued for this vulnerability