BBOT Symlink Bypass via Legacy p7zip Archives

Executive Summary

The vulnerability exists in BBOT's unarchive module, which is responsible for extracting archive files. While it correctly rejects archives containing symlink entries for tar archives, it fails to detect symlinks in zip and 7z archives if those symlinks have a DOS-attribute prefix before the Unix mode, as produced by legacy versions of p7zip.

This flaw allows an attacker to craft a malicious zip or 7z archive containing symlinks that bypass the symlink rejection check during extraction. When such an archive is downloaded and extracted during a scan, the attacker-controlled symlink can be planted into the extraction directory.

The impact is limited to planting the symlink itself; the target of the symlink is not written through. Additionally, only hosts using legacy p7zip builds that produce this DOS-attribute prefix are affected, while current mainline 7-Zip versions are not vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to place malicious symbolic links into the extraction directory during archive extraction. Although the symlink target is not overwritten, the presence of attacker-controlled symlinks could potentially be used to mislead processes or users accessing files through these links.

The risk is somewhat limited due to the requirement of using legacy p7zip builds that produce the specific DOS-attribute prefix, and the vulnerability has a low CVSS score (3.1) indicating low severity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the BBOT tool's unarchive module failing to detect symlink entries in zip and 7z archives when those entries carry a DOS-attribute prefix before the Unix mode, as produced by legacy versions of p7zip.

To detect if your system is vulnerable, you should check if you are using a legacy p7zip build that produces such archives and if BBOT is extracting zip or 7z archives without properly rejecting symlinks.

Since the issue is related to symlink entries in archives, you can manually inspect zip or 7z archives for symlink entries by listing their contents and checking attributes.

• For zip archives, use: unzip -l archive.zip
• For 7z archives, use: 7z l archive.7z

Look for entries with symlink indicators or unusual attribute prefixes that might indicate symlinks (e.g., entries starting with 'l' or 'h' in Unix mode fields).

Additionally, review BBOT's version and patch level to ensure it includes the fix that properly parses the trailing Unix mode field of the Attributes value to reject symlinks.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update BBOT to the fixed version where the unarchive module properly detects and rejects symlink entries in zip and 7z archives.

This fix modifies the _check_archive_safe() function to parse the trailing Unix mode field of the Attributes value and reject entries where the type flag is 'l' (symlink) or 'h' (hardlink), preventing malicious symlinks from being extracted.

Avoid using legacy p7zip builds that produce archives with DOS-attribute prefixes before the Unix mode, or ensure that archives are scanned and sanitized before extraction.

If updating BBOT is not immediately possible, consider disabling automatic extraction of zip and 7z archives during scans or downloads to prevent exploitation.

Useful 0 Not Useful 0