Summary
A path traversal vulnerability in FlexGet's decompress plugin allows malicious archive entries to escape the intended extraction directory and write arbitrary files.
If an attacker can supply or influence an archive processed through a feed, they may overwrite application files, including Python files in the plugins directory, potentially leading to code execution.
A path traversal vulnerability in FlexGet's decompress plugin allows malicious archive entries to escape the intended extraction directory and write arbitrary files.
If an attacker can supply or influence an archive processed through a feed, they may overwrite application files, including Python files in the plugins directory, potentially leading to code execution.
Affected context
The vulnerability occurs in FlexGet deployments that use the decompress plugin to process ZIP or RAR archives obtained through feeds. It becomes risky when archive member names are not constrained to the intended extraction directory and the FlexGet process has write access to sensitive application paths, such as the plugins directory.
The vulnerability occurs in FlexGet deployments that use the decompress plugin to process ZIP or RAR archives obtained through feeds. It becomes risky when archive member names are not constrained to the intended extraction directory and the FlexGet process has write access to sensitive application paths, such as the plugins directory.
Exploit preconditions
- Attack surface: Archive handling through a FlexGet feed and the decompress plugin
- Required access: Ability to provide, publish, or influence an archive consumed by the feed
- Trigger point: Archive extraction performed by the decompress plugin
- Why exploitation is possible: Archive member paths containing traversal sequences or absolute paths may be resolved outside the intended destination
- Additional condition: The FlexGet process must have write permission to a sensitive target location
- Attack surface: Archive handling through a FlexGet feed and the decompress plugin
- Required access: Ability to provide, publish, or influence an archive consumed by the feed
- Trigger point: Archive extraction performed by the decompress plugin
- Why exploitation is possible: Archive member paths containing traversal sequences or absolute paths may be resolved outside the intended destination
- Additional condition: The FlexGet process must have write permission to a sensitive target location
Why this happens
The underlying bug is insufficient validation and canonicalization of archive member paths before extraction. When paths from an archive are trusted without confirming that their resolved destinations remain beneath the configured extraction directory, traversal components or absolute paths can redirect writes elsewhere.
This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. Writing attacker-controlled Python files into a directory loaded by the application can extend the impact from arbitrary file write to code execution.
The underlying bug is insufficient validation and canonicalization of archive member paths before extraction. When paths from an archive are trusted without confirming that their resolved destinations remain beneath the configured extraction directory, traversal components or absolute paths can redirect writes elsewhere.
This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. Writing attacker-controlled Python files into a directory loaded by the application can extend the impact from arbitrary file write to code execution.
Potential impact
- An attacker may write or overwrite files outside the intended extraction directory
- Application configuration, data, or source files could be modified
- Python files in the plugin search path could be replaced or introduced
- The FlexGet process may execute attacker-controlled code
- Integrity of feeds, jobs, and downloaded content could be compromised
- Systems with excessive permissions could expose additional files or services
- An attacker may write or overwrite files outside the intended extraction directory
- Application configuration, data, or source files could be modified
- Python files in the plugin search path could be replaced or introduced
- The FlexGet process may execute attacker-controlled code
- Integrity of feeds, jobs, and downloaded content could be compromised
- Systems with excessive permissions could expose additional files or services
General mitigation guidance
Mitigation generally focuses on treating archive member names as untrusted paths and enforcing a safe extraction boundary.
Common defensive patterns include:
- Canonicalizing each destination path and requiring it to remain beneath the extraction directory
- Rejecting absolute paths, parent-directory components, symlink escapes, and platform-specific path variants
- Extracting into a dedicated directory that is not used as an application code or plugin search path
- Applying least-privilege filesystem permissions to the FlexGet process
- Separating downloaded content from executable application resources
- Using archive handling APIs and security policies that provide safe-by-default extraction behavior
- Treating feed content and archives as untrusted regardless of their source
Mitigation generally focuses on treating archive member names as untrusted paths and enforcing a safe extraction boundary.
Common defensive patterns include:
- Canonicalizing each destination path and requiring it to remain beneath the extraction directory
- Rejecting absolute paths, parent-directory components, symlink escapes, and platform-specific path variants
- Extracting into a dedicated directory that is not used as an application code or plugin search path
- Applying least-privilege filesystem permissions to the FlexGet process
- Separating downloaded content from executable application resources
- Using archive handling APIs and security policies that provide safe-by-default extraction behavior
- Treating feed content and archives as untrusted regardless of their source
How teams detect issues like this
Detection can include static analysis and code review for archive extraction calls that use member names directly in filesystem joins or writes. Reviewers can look for missing canonical-path containment checks, handling of absolute paths, traversal segments, and symlink-aware extraction logic.
Runtime monitoring can alert on FlexGet writing outside approved extraction directories, modifying Python files, or creating files in plugin and application code paths. Policy enforcement may restrict the process to dedicated writable locations and flag unexpected archive contents during ingestion. Automated security scanners and dependency review tools can help identify related archive-extraction patterns.
Detection can include static analysis and code review for archive extraction calls that use member names directly in filesystem joins or writes. Reviewers can look for missing canonical-path containment checks, handling of absolute paths, traversal segments, and symlink-aware extraction logic.
Runtime monitoring can alert on FlexGet writing outside approved extraction directories, modifying Python files, or creating files in plugin and application code paths. Policy enforcement may restrict the process to dedicated writable locations and flag unexpected archive contents during ingestion. Automated security scanners and dependency review tools can help identify related archive-extraction patterns.
