CVE-2024-1485: Registry-support: decompress can delete files outside scope via relative paths
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
Other sources
A vulnerability was found in the decompression function of registry-support. This issue can be triggered by an unauthenticated remote attacker when tricking a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files outside the intended scope.
— GitHub
This vulnerability affects https://github.com/devfile/registry-support and more specifically as part of a decompress function where we were reading archived files from a .tar and writing them to a new location. It was reported to us that the cleaning function we were using to ensure the file paths could not escape the directory they were supposed to go to was not working properly. This allowed somebody to potentially intercept the .tar file as it was being downloaded by the client and replace it with one that contained relative file paths. These paths when read by the decompress function would escape the destination directory and potentially overwrite arbitrary files.
The commit that contains the fix is here: https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/devfile/registry-support/registry-libraryto a version that resolves this vulnerability.Fixed in 0.0.0-20240206 - Upgrade
Upgrade
devfile/registry-supportto a version that resolves this vulnerability.Patch 0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1485?
CVE-2024-1485 has been classified with a severity rating that indicates a significant risk of exploitation due to its ability to facilitate remote code execution.
How do I fix CVE-2024-1485?
To fix CVE-2024-1485, users should update the affected software packages to the latest versions that address this vulnerability.
Who is affected by CVE-2024-1485?
CVE-2024-1485 affects users of the registry-support library, as well as those utilizing Red Hat OpenShift and its developer tools.
What causes CVE-2024-1485?
CVE-2024-1485 is caused by a flaw in the decompression functionality that allows an unauthenticated attacker to manipulate a devfile creation process.
What are the potential impacts of CVE-2024-1485?
The potential impacts of CVE-2024-1485 include the execution of arbitrary code and possible data breaches due to the exploitation of malicious archives.