CVE-2019-13623: Path Traversal
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis result is archived for sharing with other persons. To achieve arbitrary code execution, one approach is to overwrite some critical Ghidra modules, e.g., the decompile module.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-13623.
What is the severity rating for CVE-2019-13623?
CVE-2019-13623 has a severity rating of 7.8 (high).
What software is affected by CVE-2019-13623?
NSA Ghidra versions up to and including 9.0.4 are affected by CVE-2019-13623.
How does the vulnerability in RestoreTask.java occur?
The vulnerability in RestoreTask.java occurs due to path traversal, where an archive with an executable file that has an initial '../' in its filename can lead to arbitrary file overwrites.
Where can I find more information about CVE-2019-13623?
More information about CVE-2019-13623 can be found at the following references: [1](http://blog.fxiao.me/ghidra/), [2](http://packetstormsecurity.com/files/154015/Ghidra-Linux-9.0.4-Arbitrary-Code-Execution.html), [3](https://ghidra-sre.org/releaseNotes_9.1_final.html).