15-Year-Old Bug in PEAR PHP Repository Could've Enabled Supply Chain Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-36193 | Symlink Directory Traversal File Write in PEAR Archive_Tar (PHP, Drupal, Debian, Fedora) PEAR Archive_Tar through 1.4.11 mishandles symbolic links when unpacking archives, allowing write operations with directory traversal (CWE-22/CWE-59; a related issue to CVE-2020-28948). An attacker who can get a vulnerable application to extract a crafted .tar archive can slip symlinks past the checks in Tar.php and write files outside the intended extraction directory with the privileges of the PHP process, an arbitrary file-write condition with high integrity impact and the potential for supply-chain-style compromise given how widely the library is embedded. Anyone running PHP applications that use Archive_Tar to unpack user-supplied archives is affected, including Drupal, which bundles the library, plus systems with the library packaged in Debian or Fedora. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-08-25, and EPSS estimates a ~71% probability of exploitation within 30 days (99th percentile). No public proof-of-concept is known, but KEV listing confirms observed exploitation in the wild. Do: Upgrade PEAR Archive_Tar to 1.4.12 or later (the first release after the affected range through 1.4.11) and pull in the corresponding updates from Debian, Fedora, and Drupal per vendor advisories. Audit whether your PHP applications extract user-supplied .tar archives via Archive_Tar and, until patched, restrict or validate symlink handling in extraction paths. This vulnerability is on CISA's KEV list, so apply the required vendor updates promptly. | 7.5 | 71% | KEV |
| mass≈1,000,000+ installations (Drupal's roughly one-million-site install base alone, plus Archive_Tar packaged in Debian/Fedora and bundled across the PHP… |
Full article401 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananApr 02, 2022
A 15-year-old security vulnerability has been disclosed in the PEAR PHP repository that could permit an attacker to carry out a supply chain attack, including obtaining unauthorized access to publish rogue packages and execute arbitrary code.
"An attacker exploiting the first one could take over any developer account and publish malicious releases, while the second bug would allow the attacker to gain persistent access to the central PEAR server," SonarSource vulnerability researcher Thomas Chauchefoin said in a write-up published this week.
PEAR, short for PHP Extension and Application Repository, is a framework and distribution system for reusable PHP components.
One of the issues, introduced in a code commit made in March 2007 when the feature was originally implemented, relates to the use of the cryptographically insecure mt_rand() PHP function in the password reset functionality that could allow an attacker to "discover a valid password reset token in less than 50 tries."
Armed with this exploit, a bad actor could target existing developer or administrator accounts to hijack them and publish new trojanized versions of packages already maintained by the developers, resulting in a widespread supply chain compromise.
The second vulnerability, which requires the adversary to chain it with the aforementioned flaw to attain initial access, stems from pearweb's reliance on an older version of Archive_Tar, which is susceptible to a high-severity directory traversal bug (CVE-2020-36193, CVSS score: 7.5), leading to arbitrary code execution.
"These vulnerabilities have been present for more than a decade and were trivial to identify and exploit, raising questions about the lack of security contributions from companies relying on it," Chauchefoin said.
The findings mark the second time security issues have been uncovered in the PHP supply chain in less than a year. In late April 2021, critical vulnerabilities were divulged in the Composer PHP package manager that could enable an adversary to execute arbitrary commands.
With software supply chain attacks emerging as a dangerous threat in the wake of protestware incidents aimed at widely-used libraries in the NPM ecosystem, security issues tied to code dependencies in software are back in the spotlight, prompting the Open Source Initiative to call the "weaponization of open source" an act of cyber vandalism that "outweigh[s] any possible benefit."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/04/15-year-old-bug-in-pear-php-repository.html