CVE-2024-21542

Luigi < 3.6.0 has an Arbitrary File Write vulnerability due to Zip Slip in archive extraction.

• CVSS 6.6
• CWE-29
• Input Validation and Sanitization
• Local

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.

CVE

CVE-2024-21542

CWE

CWE-29

CVSS base score

6.6

Published

2024-12-10

OWASP

A04 Insecure Design

Orthogonal defect classification

Interface

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

luigi

Fixed by upgrading

Yes

Solution

Upgrade to Luigi 3.6.0 or later.

import zipfile
import os

def extract_packages_archive(archive_path, extract_dir):
    with zipfile.ZipFile(archive_path, 'r') as zip_ref:
        for file_info in zip_ref.infolist():
            zip_ref.extract(file_info, extract_dir)

import os
import zipfile
from pathlib import Path

def extract_packages_archive(archive_path, extract_dir):
    
    if not os.path.isabs(extract_dir):
        raise ValueError("extract_dir must be an absolute path")

    extract_dir = Path(extract_dir)

    with zipfile.ZipFile(archive_path, 'r') as zip_ref:
        for file_info in zip_ref.infolist():
            extract_path = extract_dir.joinpath(file_info.filename)

            if not extract_path.is_relative_to(extract_dir):
                raise ValueError(f"Attempted zip slip: '{file_info.filename}' is not inside '{extract_dir}'")

            extract_path.parent.mkdir(parents=True, exist_ok=True)
            zip_ref.extract(file_info, str(extract_path))

import zipfile
import os

zip_file = zipfile.ZipFile('malicious.zip', 'w')
zip_file.writestr('../etc/passwd', 'test')
zip_file.close()

@misc{vaitp:cve202421542,
  title        = {{Luigi < 3.6.0 has an Arbitrary File Write vulnerability due to Zip Slip in archive extraction.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-21542},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-21542/}}
}