PT-2022-9408 · Juce+1 · Juce+1

Szarvas

·

Published

2022-01-31

·

Updated

2022-02-07

·

CVE-2021-23521

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions juce-framework/JUCE versions prior to 6.1.5
Description This issue is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target directory, allowing writing of arbitrary files on the target host. In some cases, this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object.
Recommendations For versions prior to 6.1.5, update to version 6.1.5 or later to resolve the issue. As a temporary workaround, consider disabling the uncompressTo() function on ZipFile objects until a patch is available. Restrict access to the juce ZipFile.cpp module to minimize the risk of exploitation. Avoid using the ZipFile::uncompressEntry function in the affected juce ZipFile.cpp file until the issue is resolved.

Exploit

Fix

Link Following

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2021-23521
SNYK-UNMANAGED-JUCEFRAMEWORKJUCE-2388608

Affected Products

Debian
Juce