15-Year-Old Unpatched Python Vulnerability Potentially Affects Over 350,000 Projects
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-30333 | Directory Traversal in RARLAB UnRAR (Linux/UNIX) Enables Arbitrary File Writes RARLAB's UnRAR command-line decompression tool on Linux and UNIX, in versions before 6.12, contains a directory traversal flaw (CWE-22, with symlink-based path confusion per CWE-59) that lets a crafted RAR archive write files to arbitrary filesystem locations during an extract/unpack operation. It is triggered whenever an application passes an attacker-supplied archive to unrar, most prominently Zimbra Collaboration Suite, which unpacked RAR attachments from incoming email, enabling pre-authentication attacks against webmail tracked separately as CVE-2022-41352. By planting files at chosen paths — for example writing an SSH key to ~/.ssh/authorized_keys or dropping a web shell under a web root — an attacker can escalate an arbitrary file write into code execution on the server, requiring no privileges or user interaction per the CVSS vector. Only the Linux/UNIX UnRAR utility is affected; WinRAR and RAR for Android are not. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-09 with known ransomware use, public PoCs exist, and EPSS estimates a ~99% probability of exploitation within 30 days. Do: Upgrade UnRAR to 6.12 or later on all Linux and UNIX systems and apply Debian's patched unrar package; Zimbra administrators should apply Zimbra's released security patches, which ship the fixed UnRAR. As an interim mitigation, restrict or monitor services that automatically extract RAR archives from untrusted sources, and hunt for indicators such as unexpected ~/.ssh/authorized_keys entries, planted symlinks, or web shells under web roots. Because the flaw is on CISA's KEV list with known ransomware use, treat patching as time-critical. | 7.5 | 99% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed servers (dominated by Zimbra mail servers that auto-extract RAR attachments), with the total UnRAR installed base on… |
Full article366 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 22, 2022
As many as 350,000 open source projects are believed to be potentially vulnerable to exploitation as a result of a security flaw in a Python module that has remained unpatched for 15 years.
The open source repositories span a number of industry verticals, such as software development, artificial intelligence/machine learning, web development, media, security, and IT management.
The shortcoming, tracked as CVE-2007-4559 (CVSS score: 6.8), is rooted in the tarfile module, successful exploitation of which could lead to code execution from an arbitrary file write.
"The vulnerability is a path traversal attack in the extract and extractall functions in the tarfile module that allow an attacker to overwrite arbitrary files by adding the '..' sequence to filenames in a TAR archive," Trellix security researcher Kasimir Schulz said in a writeup.
Originally disclosed in August 2007, the bug has to do with how a specially crafted tar archive can be leveraged to overwrite arbitrary files on a target machine simply upon opening the file.
Put simply, a threat actor can exploit the weakness by uploading a malicious tarfile in a manner that makes it possible to escape the directory that a file is intended to be extracted to and achieve code execution, allowing the adversary to potentially seize control of a target device.
"Never extract archives from untrusted sources without prior inspection," the Python documentation for tarfile reads. "It is possible that files are created outside of path, e.g. members that have absolute filenames starting with '/' or filenames with two dots '..'."
The vulnerability is also reminiscent of a recently disclosed security flaw in RARlab's UnRAR utility (CVE-2022-30333) that could lead to remote code execution.
Trellix has further released a custom utility called Creosote to scan for projects vulnerable to CVE-2007-4559, using it to uncover the vulnerability in the Spyder Python IDE as well as Polemarch.
"Left unchecked, this vulnerability has been unintentionally added to hundreds of thousands of open- and closed-source projects worldwide, creating a substantial software supply chain attack surface," Douglas McKee noted.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/09/15-year-old-unpatched-python.html