CVE-2022-23530 GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package

2022-12-1622:56:33

CWE-22

GitHub_M

www.cve.org

guarddog

vulnerability

patched

pypi

package

shutil

unpack_archive

zipfile

validation

malicious paths

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

42.3%

JSON

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten. This issue is patched in version 0.1.8. Potential workarounds include using a safer module, like zipfile, and validating the location of the extracted files and discarding those with malicious paths.

CNA Affected

[
  {
    "vendor": "DataDog",
    "product": "guarddog",
    "versions": [
      {
        "version": "< 0.1.8",
        "status": "affected"
      }
    ]
  }
]