Summary
GluonTS archive extraction may allow a crafted tar archive to write files outside the intended extraction directory through symbolic or hard links. If an attacker can supply an archive that is extracted, the writes occur with the privileges of the extracting process.
GluonTS archive extraction may allow a crafted tar archive to write files outside the intended extraction directory through symbolic or hard links. If an attacker can supply an archive that is extracted, the writes occur with the privileges of the extracting process.
Affected context
The issue concerns GluonTS archive extraction utility behavior when processing tar archives containing symbolic or hard links. It may affect deployments using versions before 0.17.0 when an actor can provide an archive that the utility extracts without adequately preventing writes outside the designated directory.
The issue concerns GluonTS archive extraction utility behavior when processing tar archives containing symbolic or hard links. It may affect deployments using versions before 0.17.0 when an actor can provide an archive that the utility extracts without adequately preventing writes outside the designated directory.
Exploit preconditions
- Attack surface: A workflow or service that extracts tar archives using the GluonTS utility
- Required access: Ability to supply or influence an archive that will be extracted
- Trigger point: Processing the crafted archive during extraction
- Why exploitation is possible: Links in the archive may cause file writes to resolve outside the intended extraction directory, using the extracting process's privileges
- Attack surface: A workflow or service that extracts tar archives using the GluonTS utility
- Required access: Ability to supply or influence an archive that will be extracted
- Trigger point: Processing the crafted archive during extraction
- Why exploitation is possible: Links in the archive may cause file writes to resolve outside the intended extraction directory, using the extracting process's privileges
Why this happens
The underlying issue is insufficient containment of archive extraction paths. Symbolic or hard links in an archive can redirect writes beyond the intended destination if extraction does not safely validate link targets and resolved paths. This is a path traversal weakness mapped to CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
The underlying issue is insufficient containment of archive extraction paths. Symbolic or hard links in an archive can redirect writes beyond the intended destination if extraction does not safely validate link targets and resolved paths. This is a path traversal weakness mapped to CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Potential impact
- An attacker may overwrite or create files outside the extraction directory
- Sensitive files could be altered, potentially affecting application behavior
- Writes may gain the privileges of the process performing extraction
- Compromise of files or services accessible to that process could follow
- An attacker may overwrite or create files outside the extraction directory
- Sensitive files could be altered, potentially affecting application behavior
- Writes may gain the privileges of the process performing extraction
- Compromise of files or services accessible to that process could follow
General mitigation guidance
Defensive approaches focus on keeping archive extraction confined to an explicitly designated directory.
- Reject or safely handle links whose resolved targets escape the extraction root
- Canonicalize and validate destination paths before writing files
- Prefer extraction APIs with secure-by-default path and link handling
- Treat externally supplied archives as untrusted input and limit their influence
- Run extraction with least privilege and restrict filesystem write access
Defensive approaches focus on keeping archive extraction confined to an explicitly designated directory.
- Reject or safely handle links whose resolved targets escape the extraction root
- Canonicalize and validate destination paths before writing files
- Prefer extraction APIs with secure-by-default path and link handling
- Treat externally supplied archives as untrusted input and limit their influence
- Run extraction with least privilege and restrict filesystem write access
How teams detect issues like this
- Use static analysis to identify archive extraction code that does not validate normalized paths and link targets
- Review code for link handling, destination-path checks, and assumptions that archive members remain beneath the extraction root
- Test extraction behavior with archives containing links that resolve outside the destination directory
- Enforce code review or CI policies requiring safe extraction APIs and least-privilege execution
- Automated security review tools may help flag unsafe archive handling patterns
- Use static analysis to identify archive extraction code that does not validate normalized paths and link targets
- Review code for link handling, destination-path checks, and assumptions that archive members remain beneath the extraction root
- Test extraction behavior with archives containing links that resolve outside the destination directory
- Enforce code review or CI policies requiring safe extraction APIs and least-privilege execution
- Automated security review tools may help flag unsafe archive handling patterns
Sources
| Source | Link |
|---|---|
| aws. | aws.amazon.com/ |
| github. | github.com/ |
| github. | github.com/ |
