Summary
KubeEdge's keadm utility can extract archive entries outside the intended destination because archive paths are not sufficiently validated. When an attacker can influence the archive source or replace an archive used during installation or node joining, the process may overwrite files with its own privileges, potentially enabling persistent modification or code execution.
Affected context
The issue occurs in KubeEdge keadm installations or join operations performed on Windows edge nodes when the DecompressTarGz function processes an archive. Risk depends on whether the archive can be influenced through a compromised download source, replacement, or another untrusted distribution path, and on the privileges available to the affected keadm process.
Exploit preconditions
- Attack surface: Archive extraction during
keadminstallation or node joining - Required access: Ability to influence, replace, or provide the archive consumed by the affected process
- Trigger point: Extraction of archive entries by
DecompressTarGz - Why exploitation is possible: Insufficient validation permits parent-directory components, backslashes, absolute paths, or drive-prefixed paths to resolve outside the intended extraction directory
Why this happens
The underlying bug is a path traversal condition caused by joining archive entry names with an extraction destination without enforcing a canonical, confined target path. On Windows, platform-specific path syntax—including backslashes, absolute paths, and drive prefixes—can bypass assumptions based only on relative forward-slash paths. This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, where attacker-influenced names can direct file operations beyond the intended location.
Potential impact
- Arbitrary files may be created or overwritten with the privileges of the
keadmprocess - Configuration, executable, or service files could be modified
- System persistence could be established
- The affected edge node may experience unauthorized code execution
- Node integrity and connected workload environments could be compromised
General mitigation guidance
Mitigation generally focuses on confining every extracted file to the intended destination before writing it.
Common defensive patterns include:
- Canonicalizing and validating archive entry paths before extraction
- Rejecting parent-directory traversal, absolute paths, drive-prefixed paths, and platform-specific separator variants
- Verifying that the resolved destination remains within the approved extraction directory
- Using extraction libraries or APIs with explicit traversal protections
- Treating downloaded archives as untrusted and enforcing authenticated integrity checks
- Running installation utilities with the minimum privileges required
- Separating writable temporary extraction locations from configuration, executable, and service directories
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis rules targeting archive extraction and path concatenation
- Code review checks for canonicalization followed by destination-boundary validation
- Tests containing traversal markers, absolute paths, drive prefixes, and both Windows and Unix-style separators
- Policy checks requiring archive integrity verification before installation
- Runtime monitoring for unexpected writes outside designated temporary or installation directories
- Automated security review tools that flag archive extraction without path confinement
