CVE-2018-1002200: Path Traversal
A vulnerability has been found in the way developers have implemented the archive extraction of files. An arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar,xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. Of course if an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily. This affects multiple libraries that lacks of a high level APIs that provide the archive extraction functionality.
References: https://github.com/codehaus-plexus/plexus-archiver/pull/87
Patch: https://github.com/codehaus-plexus/plexus-archiver/commit/58bc24e465c0842981692adbf6d75680298989de
Other sources
plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1002200?
CVE-2018-1002200 is classified as a medium severity vulnerability due to its potential for directory traversal attacks.
How do I fix CVE-2018-1002200?
To fix CVE-2018-1002200, upgrade plexus-archiver to version 3.6.0 or later.
What systems are affected by CVE-2018-1002200?
CVE-2018-1002200 affects all versions of plexus-archiver prior to 3.6.0.
What types of attacks can be conducted using CVE-2018-1002200?
CVE-2018-1002200 allows attackers to exploit directory traversal vulnerabilities leading to the potential write of files outside the target directory.
Is there a known workaround for CVE-2018-1002200?
There are no specific workarounds for CVE-2018-1002200 other than upgrading to the patched version.