Executive Summary

This vulnerability exists in the BentoML Python library versions prior to 1.4.36. The issue is in the safe_extract_tarfile() function, which is designed to safely extract tar files by ensuring that each file's path stays within the intended extraction directory. However, for symbolic link (symlink) members, the function only checks the symlink's own path and not the path of the target the symlink points to.

An attacker can exploit this by creating a malicious tar file that contains a symlink pointing outside the extraction directory, followed by a regular file that writes through this symlink. This allows the attacker to write arbitrary files anywhere on the host filesystem during extraction.

This vulnerability is fixed in BentoML version 1.4.36.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary file write on the host filesystem when extracting a malicious tar file using vulnerable versions of BentoML. An attacker could overwrite or create files outside the intended directory, potentially leading to unauthorized modification of system files, configuration files, or application data.

Such unauthorized file writes can be used to escalate privileges, execute malicious code, disrupt services, or compromise the integrity and availability of the system.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade BentoML to version 1.4.36 or later, where the issue with safe_extract_tarfile() handling of symlinks has been fixed.

Useful 0 Not Useful 0