CVE-2024-6232

CPython vulnerability allows ReDoS via excessive regex backtracking in tarfile.

• CVSS 7.5
• CWE-1333
• Input Validation and Sanitization
• Remote

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

CVE

CVE-2024-6232

CWE

CWE-1333

CVSS base score

7.5

Published

2024-09-03

OWASP

A03 Injection

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

Python 3.10.

Fixed by upgrading

Yes

Solution

Upgrade to CPython 3.10.8 or later, which includes a fix for this vulnerability.

import tarfile
import re

def tarfile_extract(tar_path, extract_path):
    with tarfile.open(tar_path, 'r') as tar:
        for member in tar.getmembers():
            if re.match(r'^(.*?)(\.\.?)', member.name):
                tar.extract(member, path=extract_path)

import tarfile
import re

def tarfile_extract(tar_path, extract_path):
    with tarfile.open(tar_path, 'r') as tar:
        for member in tar.getmembers():
            if re.match(r'^[\w\-. ]+$', member.name):
                tar.extract(member, path=extract_path)
            else:
                raise ValueError("Unsafe tar member name detected")

# Example of a specially-crafted tar archive that triggers excessive backtracking
# This is a conceptual representation and cannot be executed as-is.

# Create a tar file with a maliciously crafted file name
# The file name is designed to exploit the regex vulnerability
# The actual creation of such a tar file would require a specific setup and is not provided here.

malicious_payload.tar:
    "a" * 1000 + "!" + "b" * 1000 + ".."  # Example of a long repetitive pattern

@misc{vaitp:cve20246232,
  title        = {{CPython vulnerability allows ReDoS via excessive regex backtracking in tarfile.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-6232},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-6232/}}
}