CVE-2022-23530

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-23530
GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten. This issue is patched in version 0.1.8. Potential workarounds include using a safer module, like zipfile, and validating the location of the extracted files and discarding those with malicious paths.

5.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://github.com/DataDog/guarddog/blob/a1d064ceb09d39bb28deb6972bc0a278756ea91f/guarddog/scanners/package_scanner.py#L153..158 Exploit Third Party Advisory
https://github.com/DataDog/guarddog/commit/37c7d0767ba28f4df46117d478f97652594c491c Patch Third Party Advisory
https://github.com/DataDog/guarddog/security/advisories/GHSA-78m5-jpmf-ch7v Exploit Third Party Advisory
https://github.com/DataDog/guarddog/blob/a1d064ceb09d39bb28deb6972bc0a278756ea91f/guarddog/scanners/package_scanner.py#L153..158 Exploit Third Party Advisory
https://github.com/DataDog/guarddog/commit/37c7d0767ba28f4df46117d478f97652594c491c Patch Third Party Advisory
https://github.com/DataDog/guarddog/security/advisories/GHSA-78m5-jpmf-ch7v Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:datadoghq:guarddog:*:*:*:*:*:python:*:*
History

21 Nov 2024, 06:48

Type Values Removed Values Added
References () https://github.com/DataDog/guarddog/blob/a1d064ceb09d39bb28deb6972bc0a278756ea91f/guarddog/scanners/package_scanner.py#L153..158 - Exploit, Third Party Advisory () https://github.com/DataDog/guarddog/blob/a1d064ceb09d39bb28deb6972bc0a278756ea91f/guarddog/scanners/package_scanner.py#L153..158 - Exploit, Third Party Advisory
References () https://github.com/DataDog/guarddog/commit/37c7d0767ba28f4df46117d478f97652594c491c - Patch, Third Party Advisory () https://github.com/DataDog/guarddog/commit/37c7d0767ba28f4df46117d478f97652594c491c - Patch, Third Party Advisory
References () https://github.com/DataDog/guarddog/security/advisories/GHSA-78m5-jpmf-ch7v - Exploit, Third Party Advisory () https://github.com/DataDog/guarddog/security/advisories/GHSA-78m5-jpmf-ch7v - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : 6.5 		v2 : unknown
v3 : 5.8
Summary
  • (es) GuardDog es una herramienta CLI para identificar paquetes PyPI maliciosos. Las versiones anteriores a la v0.1.8 son vulnerables a la escritura arbitraria de archivos al escanear un paquete PyPI remoto especialmente manipulado. Extraer archivos utilizandoshutil.unpack_archive() de un tarball potencialmente malicioso sin validar que la ruta del archivo de destino esté dentro del directorio de destino deseado puede provocar que se sobrescriban los archivos fuera del directorio de destino. Este problema está solucionado en la versión 0.1.8. Los posibles workarounds incluyen el uso de un módulo más seguro, como zipfile, y validar la ubicación de los archivos extraídos y descartar aquellos con rutas maliciosas.
Information

Published : 2022-12-16 23:15

Updated : 2024-11-21 06:48

NVD link : CVE-2022-23530

Mitre link : CVE-2022-23530

CVE.ORG link : CVE-2022-23530

JSON object : View

Products Affected

datadoghq

  • guarddog
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')