Repository navigation
[python] TarSlip vulnerability improvements #710
Description
Query PR
github/codeql#10851 (closed in favor of the next one)
github/codeql#10887
Language
Python
CVE(s) ID list
- https://huntr.dev/bounties/2d1db3c9-93e8-4902-a55b-5ea53c22aa11/
- https://huntr.dev/bounties/309725a2-bfc9-4ef3-a4c1-360a9f6b890b/
more to come.
CWE
CWE-022
Report
- TarSlip vulnerability.
- _Extracting files from a malicious tarball without validating that the destination file path is within the destination directory can cause files outside the destination directory to be overwritten, due to the possible presence of directory traversal elements (
..) in archive path names. - I have added more sources and sinks than I checked the combination use of both.
- Yes, I've checked the query against valid samples extracted from https://github.com/proxy/cs.github.com/. I ethically reported them using https://huntr.dev (more to become public soon).
- This is my first contribution, and I would love to provide more.
Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).
- Yes
- No
Activity
ghsecuritylab commentedon Oct 17, 2022
Your submission is now in status Test run.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
ghsecuritylab commentedon Oct 18, 2022
Your submission is now in status Query review.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
ghsecuritylab commentedon Oct 18, 2022
Your submission is now in status Results analysis.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
Sim4n6 commentedon Oct 19, 2022
Re-adapted the PR into this one: github/codeql#10887
Sim4n6 commentedon Oct 25, 2022
PR merged github/codeql#10887 💯
Sim4n6 commentedon Nov 10, 2022
Any update related to this issue, please? 🙃
JarLob commentedon Nov 10, 2022
Hi @Sim4n6,
Sorry that it takes so long. As I see it is very close to resolution. Unfortunately GitHub Universe 2022 may delay the final step for few days more. I'll ping people and maybe it will be resolved sooner.
ghsecuritylab commentedon Nov 10, 2022
Your submission is now in status Final decision.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
xcorail commentedon Nov 15, 2022
Hello @Sim4n6
Can you please provide a public email address, or send me privately a private one?
Thanks
ghsecuritylab commentedon Nov 15, 2022
Your submission is now in status Pay.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
Sim4n6 commentedon Nov 15, 2022
Sim4n6@gmail.com
xcorail commentedon Nov 16, 2022
Created Hackerone report 1775224 for bounty 438181 : [710] [python] TarSlip vulnerability improvements
ghsecuritylab commentedon Nov 16, 2022
Your submission is now in status Closed.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
Sim4n6 commentedon Nov 16, 2022
Thank you very much.