Path Traversal in py7zr Archive Extraction

Compliance Impact

The vulnerability in py7zr prior to version 1.1.3 allows a decompression bomb attack that can exhaust disk space or memory during extraction. While this primarily causes a denial of service, it does not directly disclose or compromise sensitive data.

However, denial of service incidents can impact system availability, which is a component of various compliance frameworks such as GDPR and HIPAA that require ensuring availability and integrity of data and services.

Therefore, if systems processing sensitive data use vulnerable versions of py7zr, they may face risks to availability compliance requirements until the vulnerability is mitigated by upgrading to version 1.1.3 or later.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a decompression bomb attack via specially crafted .7z archives that expand to very large sizes during extraction, potentially exhausting disk space or memory.

To detect this vulnerability on your system, you can check the version of the py7zr library installed. Versions 1.1.2 and earlier are vulnerable, while version 1.1.3 and later include a fix.

You can run the following Python command to check the installed py7zr version:

• python -c "import py7zr; print(py7zr.__version__)"

To detect if a decompression bomb attack is attempted or to test suspicious .7z files, you can try extracting them using py7zr with the max_extract_size parameter set to a safe limit (available in version 1.1.3 and later). If the extraction raises a DecompressionBombError, the file is likely malicious or crafted to trigger the vulnerability.

Example Python snippet to test extraction with size limit:

• import py7zr
• try:
• with py7zr.SevenZipFile('suspicious.7z', mode='r', max_extract_size=2*1024*1024*1024) as archive:
• archive.extractall()
• except py7zr.exceptions.DecompressionBombError:
• print('Decompression bomb detected! Extraction aborted.')

Monitoring disk and memory usage during extraction of .7z files can also help detect attempts to exploit this vulnerability.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the py7zr Python library, which is used for handling 7zip archives. Before version 1.1.3, the Worker.decompress() function did not track the total decompressed size of archive entries. This allowed an attacker to craft a small .7z archive file that, when decompressed, would expand to a very large size, such as a 15.6 KB archive expanding to 100 MB. This could cause exhaustion of disk space or memory during extraction.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to resource exhaustion on the system where the py7zr library is used. Specifically, extracting a maliciously crafted archive can consume excessive disk space or memory, potentially causing denial of service by exhausting system resources before the extraction process completes.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade py7zr to version 1.1.3 or later, where the issue with decompressing crafted .7z files that can exhaust disk or memory has been fixed.

Useful 0 Not Useful 0