Описание
PraisonAI vulnerable to arbitrary file write via path traversal in praisonai recipe unpack
| Field | Value |
|---|---|
| Severity | Critical |
| Type | Path traversal -- arbitrary file write via tar.extract() without member validation |
| Affected | src/praisonai/praisonai/cli/features/recipe.py:1170-1172 |
Summary
cmd_unpack in the recipe CLI extracts .praison tar archives using raw tar.extract() without validating archive member paths. A .praison bundle containing ../../ entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim's filesystem when they run praisonai recipe unpack.
Details
The vulnerable code is in cli/features/recipe.py:1170-1172:
The only check is whether the member is manifest.json. The code never validates member names -- absolute paths, .. components, and symlinks all pass through. Python's tarfile.extract() resolves these relative to the destination, so a member named ../../.bashrc lands two directories above recipe_dir.
The codebase does contain a safe extraction function (_safe_extractall in recipe/registry.py:131-162) that rejects absolute paths, .. segments, and resolved paths outside the destination. It is used by the pull and publish paths, but cmd_unpack does not call it.
PoC
Build a malicious bundle:
Trigger:
Impact
| Path | Traversal blocked? |
|---|---|
praisonai recipe pull <name> | Yes -- uses _safe_extractall |
praisonai recipe publish <bundle> | Yes -- uses _safe_extractall |
praisonai recipe unpack <bundle> | No -- raw tar.extract() |
An attacker needs to get a victim to unpack a malicious .praison bundle -- say, through a shared recipe repository, a link in a tutorial, or by sending it to a colleague directly.
Depending on filesystem permissions, an attacker can overwrite shell config files (.bashrc, .zshrc), cron entries, SSH authorized_keys, or project files in parent directories. The attacker controls both the path and the content of every written file.
Remediation
Replace the raw extraction loop with _safe_extractall:
Affected paths
src/praisonai/praisonai/cli/features/recipe.py:1170-1172--cmd_unpackextracts tar members without path validation
Пакеты
PraisonAI
>= 2.7.2, < 4.5.128
4.5.128
Связанные уязвимости
PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the recipe CLI extracts .praison tar archives using raw tar.extract() without validating archive member paths. A .praison bundle containing ../../ entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim's filesystem when they run praisonai recipe unpack. This vulnerability is fixed in 4.5.128.