CVE-2007-4559

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python

• CVSS 9.8
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

CVE

CVE-2007-4559

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

9.8

Published

2007-08-28

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to Python version 2.7.18 or 3.8.8 or higher.

import tarfile

def extract(tar, path="."):
    tar.extractall(path)

with tarfile.open('example.tar', 'r') as tar:
    extract(tar, path='target_directory')

import tarfile
import os

def extract(tar, path=".", members=None, *, numeric_owner=False):
    if members is None:
        members = tar.getmembers()
    for member in members:
        member_path = os.path.join(path, member.name)
        if os.path.commonpath([path, member_path]) != path:
            raise Exception("Attempted Path Traversal in Tar File")
        
        tar.extract(member, path, numeric_owner=numeric_owner)

with tarfile.open('example.tar', 'r') as tar:
    extract(tar, path='target_directory')

@misc{vaitp:cve20074559,
  title        = {{Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2007},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2007-4559},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2007-4559/}}
}