Directory Traversal in Pulp RPM Distribution Publishing

Executive Summary

This vulnerability in pulp-rpm occurs when publishing a distribution tree. It allows a user with sync or upload permissions to create a new directory outside the intended task area by using addon and variant IDs from .treeinfo files as directory names. The flaw does not expose data or disrupt service but can write repository metadata and packages to unintended locations as the Pulp worker user.

Useful 0 Not Useful 0

Detection Guidance

Check for unexpected directories created by the Pulp worker user outside the task work area. Review pulp-rpm logs for directory creation errors or unusual paths during distribution tree publishing. Look for directories named after addon or variant IDs from .treeinfo files in unintended locations.

Useful 0 Not Useful 0

Impact Analysis

An attacker with specific permissions could create directories in unintended locations, potentially writing files that could interfere with system operations or allow further exploitation. However, the impact is limited because the attack cannot replace existing files or directories and requires existing parent paths.

Useful 0 Not Useful 0

Mitigation Strategies

Sync distribution trees only from trusted sources. Avoid publishing repository versions containing distribution trees until updates are applied. Monitor for unauthorized directory creation by the Pulp worker user.

Useful 0 Not Useful 0