CVE-2020-27833

Description

A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image (.tar file) which contains symbolic links. The vulnerability is limited to the command oc image extract. If a symbolic link is first created pointing within the tarball, this allows further symbolic links to bypass the existing path check. This flaw allows the tarball to create links outside the tarball's parent directory, allowing for executables or configuration files to be overwritten, resulting in arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Mitigation

The option `--only-files=true` can be specified to ensure that only files and directories from the image are extracted and symbolic links are ignored. While this means that if a image does implement malicious symbolic links, no links will be created outside the parent tarball. However, this does mean that if legitimate symbolic links are specific within the image these will also not be created.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score7.17.1N/A
Attack VectorNetworkNetworkN/A
Attack ComplexityHighHighN/A
Privileges RequiredLowLowN/A
User InteractionRequiredRequiredN/A
ScopeUnchangedUnchangedN/A
ConfidentialityHighHighN/A
Integrity ImpactHighHighN/A
Availability ImpactHighHighN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

NVD: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Red Hat CVSS v3 Score Explanation

Attack Complexity: High The attack cannot be simply conducted at will and relies on many factors outside the attackers control, requiring significant reconnaissance first. Yes it could potentially be used in a watering hole style attack - upload to DockerHub, wait and hope that a user then uses oc image extract. This is unlikely tho. A more likely scenario here would be to socially engineer a user to run oc image extract.

Privileges Required: Low To enable an actor to perform an attack they need some level of privilege in the container registry to upload a malicious image. This has been determined to be the most likely attack vector as it's very unlikely to be emailing a victim a tar of an image and ask them to extract it with the oc tool. It would more than likely be uploaded to a registry like Quay or DockerHub and then have someone download from that.

Understanding the Weakness (CWE)

CWE-20

Availability

Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)

An attacker could provide unexpected values and cause a program crash or arbitrary control of resource allocation, leading to excessive consumption of resources such as memory and CPU.

Confidentiality

Technical Impact: Read Memory; Read Files or Directories

An attacker could read confidential data if they are able to control resource references.

Integrity,Confidentiality,Availability

Technical Impact: Modify Memory; Execute Unauthorized Code or Commands

An attacker could use malicious input to modify data or possibly alter control flow in unexpected ways, including arbitrary command execution.

Acknowledgements

Red Hat would like to thank Chris Smowton (GitHub Security Lab) for reporting this issue.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.