Symlink Escape in bit7z Archive Extraction

Executive Summary

This vulnerability exists in bit7z, a cross-platform C++ static library used for compressing and extracting archive files. Before version 4.0.12, there was a one-byte off-by-one error in the function SafeOutPathBuilder::restoreSymlink(). This error allows an attacker to create a specially crafted .7z archive that, when extracted on any non-Windows platform, can create a symbolic link (symlink) that escapes the intended extraction directory.

Because of this symlink escape, subsequent files extracted from the archive can be written outside the designated extraction folder, potentially overwriting arbitrary files on the system with the permissions of the extracting process.

This issue was fixed in bit7z version 4.0.12.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to write arbitrary files outside the intended extraction directory when you extract a malicious .7z archive using bit7z on a non-Windows platform.

The attacker could potentially overwrite important system or application files, leading to unauthorized modification of data, disruption of services, or execution of malicious code with the permissions of the user performing the extraction.

The impact depends on the permissions of the extracting process, but it can lead to integrity and availability issues on the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade bit7z to version 4.0.12 or later, where the issue has been patched.

Avoid extracting .7z archives from untrusted sources on non-Windows platforms until the upgrade is applied.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a crafted .7z archive that creates a symlink escaping the intended extraction directory on non-Windows systems. Detection involves identifying suspicious symlinks created during extraction that point outside the expected directory.

To detect exploitation attempts or presence of this vulnerability on your system, you can:

• Monitor extracted directories for unexpected symlinks pointing outside the extraction path.
• Use commands to find symlinks that point outside a given directory, for example:
• find /path/to/extraction -type l -exec bash -c 'target=$(readlink -f "$0"); [[ "$target" != /path/to/extraction/* ]] && echo "$0 -> $target"' {} \;
• Check for unexpected file modifications outside extraction directories that could indicate arbitrary file writes.

Additionally, ensure your bit7z library version is 4.0.12 or later, as this vulnerability is patched in that version.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to write arbitrary files outside the intended extraction directory, potentially overwriting sensitive files such as .bashrc, .ssh/authorized_keys, or crontab files. This could lead to unauthorized access, arbitrary code execution, or privilege escalation.

Such unauthorized file modifications and potential data breaches could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and prevention of unauthorized access.

However, the attack complexity is high, user interaction is required, and the impact is limited to one directory level above the extraction directory. Additionally, the vulnerability is patched in version 4.0.12.

Useful 0 Not Useful 0