PT-2022-17564 · Unknown · One-Java-Agent-Plugin

Akhil Jain · Published 2022-05-01 · Updated 2022-05-11 · CVE-2022-25842

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions one-java-agent-plugin versions all

Description The issue allows for Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.

Recommendations For all versions, consider restricting the use of archive extraction functionality until a patch is available. As a temporary workaround, avoid using the one-java-agent-plugin package with untrusted archives to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

CWE-29

Related Identifiers

CVE-2022-25842

GHSA-9HR3-J9MC-XMQ2

SNYK-JAVA-COMALIBABAONEAGENT-2407874

Affected Products

One-Java-Agent-Plugin

References · 9

• 🔥 https://github.com/alibaba/one-java-agent/blob/1f399a2299a8a409d15ea6111a7098629b8f1050/one-java-agent-plugin/src/main/java/com/alibaba/oneagent/utils/IOUtils.java · Exploit
• https://github.com/alibaba/one-java-agent/pull/29 · Patch
• https://osv.dev/vulnerability/CVE-2022-25842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25842 · Security Note
• https://osv.dev/vulnerability/GHSA-9hr3-j9mc-xmq2 · Vendor Advisory
• https://github.com/alibaba/one-java-agent/pull/29/commits/359603b63fc6c59d8b57e061c171954bab3433bf · Note
• https://github.com/alibaba/one-java-agent · Note
• https://github.com/alibaba/one-java-agent/pull/29/commits/b5b437f9f4c8cbfe7bdbe266e975a4bd513c13fe · Note
• https://snyk.io/vuln/SNYK-JAVA-COMALIBABAONEAGENT-2407874 · Note