Path Traversal in VisiData EmailSheet

Executive Summary

This is a path traversal vulnerability in VisiData's EmailSheet extract_parts function. It allows a specially crafted .eml file to write arbitrary files outside the intended directory. The issue occurs when a malicious .eml file contains a MIME part with a filename parameter using path traversal sequences like ../. When a user opens the file and extracts attachments, the malicious file is written to the traversed path.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for suspicious .eml files with MIME parts containing path traversal sequences like '../' in filenames. Check for unexpected file writes outside intended directories, especially in user home directories or system paths. Review VisiData logs for extract_parts function usage with malformed filenames.

Useful 0 Not Useful 0

Impact Analysis

An attacker could overwrite sensitive files such as shell initialization files or SSH authorized keys. This could lead to system compromise, unauthorized access, or further attacks. Exploitation requires user interaction to open the malicious .eml file and trigger extraction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file writes, potentially compromising data integrity and confidentiality. This may violate GDPR's data protection principles or HIPAA's security requirements for safeguarding sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update VisiData to the latest version that patches this vulnerability. Avoid opening untrusted .eml files in VisiData. Implement file integrity monitoring to detect unauthorized file modifications. Restrict write permissions in directories where VisiData extracts files.

Useful 0 Not Useful 0