Symlink Arbitrary File Write in Perl Archive::Tar

Executive Summary

The vulnerability exists in Archive::Tar versions before 3.08 for Perl, where the module extracts symbolic links (symlinks) with attacker-controlled targets outside the intended extraction directory.

Specifically, the _make_special_file() function passes the tar header's linkname directly to the symlink() system call without validating whether the target is an absolute path or contains directory traversal sequences like "..".

While there is a secure-extract mode that guards regular file extraction, it does not check symlink targets, allowing an attacker to create symlinks pointing outside the extraction directory.

This can lead to subsequent file operations (like open) on these symlinked paths, potentially reading or writing files outside the intended directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to perform directory traversal attacks by creating symlinks that point outside the extraction directory.

As a result, an attacker could cause the application to read from or write to arbitrary files on the filesystem, potentially leading to unauthorized file access or modification.

This could compromise system integrity, leak sensitive information, or allow malicious modification of files, depending on the privileges of the process performing the extraction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the extraction of symlinks with attacker-controlled targets outside the intended extraction directory by Archive::Tar versions before 3.08 for Perl.

To detect exploitation attempts or presence of this vulnerability on your system, you can check for symlinks created outside of expected extraction directories, especially those pointing to absolute paths or containing directory traversal sequences like "..".

Suggested commands to help detect suspicious symlinks include:

• Find symlinks outside the extraction directory (replace /path/to/extract): find /path/to/extract -type l -exec ls -l {} +
• Check symlink targets for absolute paths or directory traversal: find /path/to/extract -type l -exec readlink {} \; | grep -E '^/|\.\.'

Monitoring logs or audit trails for unexpected file creations or accesses outside extraction directories may also help detect exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to update Archive::Tar to version 3.08 or later, where the vulnerability is fixed by validating symlink and hardlink targets in secure extract mode.

If immediate update is not possible, avoid extracting untrusted tar archives using vulnerable versions of Archive::Tar, especially those containing symlinks or hardlinks.

Additionally, consider running extraction processes with least privilege and in isolated environments to limit potential damage from directory traversal or unauthorized file access.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Archive::Tar allows extraction of symlinks with attacker-controlled targets outside the intended extraction directory, potentially leading to unauthorized file access or directory traversal attacks.

Such unauthorized access or modification of files could result in exposure or alteration of sensitive data, which may violate data protection requirements under standards like GDPR or HIPAA.

Therefore, this vulnerability could negatively impact compliance with these regulations by undermining the confidentiality and integrity of protected data.

Useful 0 Not Useful 0