Experts discovered 15-Year-Old vulnerabilities in the PEAR PHP repository
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-36193 | Symlink Directory Traversal File Write in PEAR Archive_Tar (PHP, Drupal, Debian, Fedora) PEAR Archive_Tar through 1.4.11 mishandles symbolic links when unpacking archives, allowing write operations with directory traversal (CWE-22/CWE-59; a related issue to CVE-2020-28948). An attacker who can get a vulnerable application to extract a crafted .tar archive can slip symlinks past the checks in Tar.php and write files outside the intended extraction directory with the privileges of the PHP process, an arbitrary file-write condition with high integrity impact and the potential for supply-chain-style compromise given how widely the library is embedded. Anyone running PHP applications that use Archive_Tar to unpack user-supplied archives is affected, including Drupal, which bundles the library, plus systems with the library packaged in Debian or Fedora. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-08-25, and EPSS estimates a ~71% probability of exploitation within 30 days (99th percentile). No public proof-of-concept is known, but KEV listing confirms observed exploitation in the wild. Do: Upgrade PEAR Archive_Tar to 1.4.12 or later (the first release after the affected range through 1.4.11) and pull in the corresponding updates from Debian, Fedora, and Drupal per vendor advisories. Audit whether your PHP applications extract user-supplied .tar archives via Archive_Tar and, until patched, restrict or validate symlink handling in extraction paths. This vulnerability is on CISA's KEV list, so apply the required vendor updates promptly. | 7.5 | 71% | KEV |
| mass≈1,000,000+ installations (Drupal's roughly one-million-site install base alone, plus Archive_Tar packaged in Debian/Fedora and bundled across the PHP… |
Full article423 words · extracted from securityaffairs.com · click to collapse
SonarSource discovered a 15-year-old flaw in the PEAR PHP repository that could have enabled supply chain attacks.
Researchers from SonarSource discovered two 15-year-old security flaws in the PEAR (PHP Extension and Application Repository) repository that could have enabled supply chain attacks.
PEAR is a framework and distribution system for reusable PHP components.
According to the expert, the critical vulnerability in a central component of the PHP supply chain could have been easily exploited by low-skilled threat actors to cause important disruption.
“An attacker exploiting the first one could take over any developer account and publish malicious releases, while the second bug would allow the attacker to gain persistent access to the central PEAR server.” reads the post published by SonarSource.
One of the flaws discovered by the experts is related to the use of the cryptographically week mt_rand() PHP function in the password reset functionality that could allow an attacker to discover a valid password reset token in less than 50 tries.
Once obtained the password for a developer’s account, threat actors can use it to conduct a supply chain attack by pushing a tainted version of their packages.
Experts explained that the source code behind pear.php.net can be found in a project named pearweb, which is available on GitHub.
Upon deploying pearweb on their test virtual machine, the researchers discovered that it pulled the dependency Archive_Tar in an old version (1.4.7, while the last one is 1.4.14). The older version of Archive_Tar is known to be affected by a directory traversal flaw tracked as (CVE-2020-36193) that could potentially lead to arbitrary code execution.
“These vulnerabilities have been present for more than a decade and were trivial to identify and exploit, raising questions about the lack of security contributions from companies relying on it,” concludes the analysis.
The researchers published a video PoC of the attack exploring the flaws to achieve arbitrary code execution on their local PEAR instance:
In April 2021, the same team of researchers discovered another vulnerability in the PHP Composer that could have allowed an attacker to execute arbitrary commands and backdoor every PHP package.
Please vote Security Affairs as best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and other of your choice.
To nominate, please visit: https://forms.gle/4D4PygUVcNxFQ6iFA
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, PEAR PHP)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/129797/hacking/pear-php-critical-flaws.html