Описание
gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
Summary
The gdown library (tested on v5.2.1) is vulnerable to a Path Traversal attack within its extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE).
Details
The vulnerability exists in gdown/extractall.py within the extractall() function. The function takes an archive path and a destination directory (to), then calls the underlying extractall() method of Python's tarfile or zipfile modules without validating whether the archive members stay within the to boundary.
Vulnerable Code:
Even on modern Python versions (3.12+), if the filter parameter is not explicitly set or if the library's wrapper logic bypasses modern protections, path traversal remains possible as demonstrated in the PoC.
PoC
Steps to Reproduce
- Create the Malicious Archive (
poc.py):
- Execute the Vulnerable Function:
- Verify the Escape:
Impact
An attacker can provide a specially crafted archive that, when extracted via gdown, overwrites critical files on the victim's system.
- Arbitrary File Overwrite: Overwriting
.bashrc,.ssh/authorized_keys, or configuration files. - Remote Code Execution (RCE): By overwriting executable scripts or Python modules within a virtual environment.
Recommended Mitigation
mplement path validation to ensure that all extracted files are contained within the target directory.
Suggested Fix:
Пакеты
gdown
<= 5.2.1
5.2.2
Связанные уязвимости
gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.
gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.
gdown is a Google Drive public file/folder downloader. Versions prior ...