PT-2022-16056 · Guarddog · Guarddog
Sim4N6
·
Published
2022-12-05
·
Updated
2022-12-22
·
CVE-2022-23530
CVSS v3.1
5.8
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
GuardDog versions prior to v0.1.8
Description
GuardDog is a CLI tool to identify malicious PyPI packages. The issue arises when extracting files using
shutil.unpack archive() from a potentially malicious tarball without validating that the destination file path is within the intended destination directory, which can cause files outside the destination directory to be overwritten. This can be exploited by an attacker crafting a malicious tarball with a filename path, such as ../../../../../../../../etc/passwd, and serving the archive remotely, thus providing a possibility to overwrite system files.Recommendations
To resolve the issue, update to version 0.1.8 or later.
As a temporary workaround, consider using a safer module, like
zipfile, and validate the location of the extracted files, discarding those with malicious paths such as a relative path .. or absolute ones.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Guarddog