CVE-2023-7216: Cpio: extraction allows symlinks which enables remote command execution
A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks.
Other sources
Summary:
CPIO found to be vulnerable to Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution on the target.
Details:
While handling CPIO archives, the CPIO follows symlink, cpio by default will follow stored symlinks while extracting and the Archiver will not check the symlink location, which leads to arbitrary file writes to unintended locations. When the victim extracts the archive, the attacker can craft a malicious cpio archive to achieve RCE on the target system.
PoC ( Steps to reproduce ) : Complete instructions to craft a cpio archive to demonstrate the vulnerability.
mkdir testcpio ln -sf /tmp/ testcpio/tmp echo "TEST Traversal" > testcpio/tmpYtrav.txt cd testcpio/ ls | cpio -ov > ../trav.cpio cd ../ sed -i s/"tmpY"/"tmp\/"/g trav.cpio
Extract the malicious archive: cpio -i < trav.cpio
Impact: An attacker can craft malicious cpio archives that exploit the vulnerability to write files on locations such as ~/.ssh, ~/.bashrc, ~/.config/autostart/ etc., to achieve full remote command execution on the target/victim system. Software that uses CPIO as a component might be vulnerable.
Credit: Febin Mon Saji
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-7216?
CVE-2023-7216 is classified as a medium severity vulnerability due to its potential for unauthorized access.
How do I fix CVE-2023-7216?
To fix CVE-2023-7216, update the GNU cpio package to the latest version available from your distribution.
What systems are affected by CVE-2023-7216?
CVE-2023-7216 affects GNU cpio and Red Hat Enterprise Linux versions 7.0, 8.0, and 9.0.
Can CVE-2023-7216 be exploited remotely?
Yes, CVE-2023-7216 can be exploited by a remote unauthenticated attacker if users open affected archives.
What type of vulnerability is CVE-2023-7216?
CVE-2023-7216 is a path traversal vulnerability that allows symlink access outside intended directories.