Medium, CVSS 6.1GoPublished
Symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations in dbdeployer
CVE-2020-26277 · GHSA-47wr-426j-fr82
- Affected
- Go github.com/datacharmer/dbdeployer < 1.58.2
- Fixed in
- 1.58.2· Vendor fix available
- Issue
- Impact Users unpacking a tarball through dbdeployer may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a system file, thus altering the computer defences. Mitigating factors For the attach to succeed, the following factors need to contribute: The user is logged in as root. While dbdeployer is usable as root, it was designed to run as unprivileged user. The user has taken a tarball from a non secure source, without testing the checksum. When the tarball is retrieved through dbdeployer, the checksum is compared before attempting to unpack. Analysis An attacker could inject a symbolic link into the tarball, so that a file could result into fakefile - /etc/passwd or some equally important file. As it is now, dbdeployer would create the symlink as defined, with a local file fakefile linked to /etc/passwd. The danger here is that any process with the privileges to write to both…
Recommended action: Upgrade to 1.58.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.