PT-2024-9332 · Luigi · Luigi

Ali Razmjoo · Published 2024-08-24 · Updated 2024-12-10 · CVE-2024-21542

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: luigi versions prior to 3.6.0

Description: The issue is related to improper destination file path validation in the extract packages archive function, which can lead to arbitrary file write via archive extraction, also known as Zip Slip. This vulnerability can be exploited by a remote attacker using a specially crafted zip archive, potentially allowing them to execute arbitrary code.

Recommendations: For versions prior to 3.6.0, update to version 3.6.0 or later to resolve the issue. As a temporary workaround, consider disabling the extract packages archive function until a patch is available. Restrict access to the archive extraction handler to minimize the risk of exploitation. Avoid using the vulnerable function to extract archives from untrusted sources until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-29

Related Identifiers

BDU:2024-11022

CVE-2024-21542

GHSA-8QCH-VJ6M-2694

PYSEC-2024-159

Affected Products

Luigi

References · 18

• 🔥 https://github.com/L3ster1337/Poc-CVE-2024-21542 · Exploit
• https://osv.dev/vulnerability/CVE-2024-21542 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21542 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-159 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11022 · Security Note
• https://osv.dev/vulnerability/GHSA-8qch-vj6m-2694 · Vendor Advisory
• https://github.com/spotify/luigi/commit/b5d1b965ead7d9f777a3216369b5baf23ec08999 · Note
• https://github.com/spotify/luigi/releases/tag/v3.6.0 · Note
• https://github.com/spotify/luigi/issues/3301 · Note
• https://github.com/spotify/luigi · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/luigi/PYSEC-2024-159.yaml · Note
• https://vulners.com/cve/CVE-2024-21542 · Note
• https://twitter.com/VulmonFeeds/status/1866405027297857798 · Twitter Post
• https://t.me/cvedetector/12479 · Telegram Post
• https://vuldb.com/?id.287510 · Note