CVE-2020-28948 – CVE-2020-28948 is a deserialization vulnerabili... (How to Fix)

Q: What is the severity of CVE-2020-28948?

CVE-2020-28948 has a CVSS score of 7.8 (HIGH). CVE-2020-28948 is a deserialization vulnerability in Archive_Tar that allows attackers to execute arbitrary code via PHAR archive exploitation. The vulnerability exists because the library blocks 'phar:' protocol but not 'PHAR:' (uppercase), enabling case-sensitive bypass. Any PHP application using Archive_Tar version 1.4.10 or earlier is affected.

📋 TL;DR

CVE-2020-28948 is a deserialization vulnerability in Archive_Tar that allows attackers to execute arbitrary code via PHAR archive exploitation. The vulnerability exists because the library blocks 'phar:' protocol but not 'PHAR:' (uppercase), enabling case-sensitive bypass. Any PHP application using Archive_Tar version 1.4.10 or earlier is affected.

💻 Affected Systems

Products:

Archive_Tar (PEAR package)

Versions: All versions through 1.4.10

Operating Systems: All operating systems running PHP

Default Config Vulnerable: ⚠️ Yes

Notes: Any PHP application using Archive_Tar to extract archives, particularly those accepting user-uploaded files, is vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.

🟠

Likely Case

Arbitrary code execution with the privileges of the web server process, potentially allowing file system access and further exploitation.

🟢

If Mitigated

Limited impact if proper input validation and file upload restrictions are in place, though deserialization risks remain.

🌐 Internet-Facing: HIGH - Web applications processing user-uploaded archives are directly exploitable from the internet.

🏢 Internal Only: MEDIUM - Internal applications processing archives could be exploited by authenticated users or through other attack vectors.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires the ability to upload or provide a malicious PHAR archive to the vulnerable application. The vulnerability is well-documented with public proof-of-concept code available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Archive_Tar 1.4.11 and later

Vendor Advisory: https://github.com/pear/Archive_Tar/issues/33

Restart Required: No

Instructions:

1. Update Archive_Tar to version 1.4.11 or later using your package manager (e.g., 'pear upgrade Archive_Tar'). 2. If using Composer, update your composer.json to require 'pear/archive_tar: ^1.4.11' and run 'composer update'. 3. Verify the update by checking the Archive_Tar version in your application.

🔧 Temporary Workarounds

Input Validation Filter

all

Block all uppercase variations of 'phar:' protocol in archive extraction functions

// PHP code snippet to add to archive processing:
if (stripos($archive_path, 'phar:') !== false) {
    throw new Exception('PHAR protocol not allowed');
}

Disable PHAR Deserialization

all

Configure PHP to disable PHAR deserialization via php.ini settings

phar.readonly = 1
phar.require_hash = 1

🧯 If You Can't Patch

Implement strict file upload validation: only allow specific archive formats (zip, tar) and scan for malicious content
Run Archive_Tar in a restricted environment with limited filesystem access and disable dangerous PHP functions

🔍 How to Verify

Check if Vulnerable:

Check your Archive_Tar version. If using Composer: 'composer show pear/archive_tar'. If using PEAR: 'pear list Archive_Tar'. If version is 1.4.10 or earlier, you are vulnerable.

Check Version:

php -r "require_once 'Archive/Tar.php'; echo 'Archive_Tar version: ' . Archive_Tar::VERSION;"

Verify Fix Applied:

After updating, verify the version is 1.4.11 or later. Test archive extraction with a safe test file to ensure functionality remains.

📡 Detection & Monitoring

Log Indicators:

Unusual archive extraction attempts with uppercase PHAR protocol
Errors from Archive_Tar when processing archives
Unexpected file writes or code execution following archive processing

Network Indicators:

Uploads of archive files to web applications, particularly with unusual filenames or extensions

SIEM Query:

source=web_logs (archive OR tar OR extract) AND (error OR exception) AND (phar OR PHAR)

📊 Metadata

CVE ID: CVE-2020-28948

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: November 19, 2020

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-28948, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Archive Tar by Php

Debian Linux by Debian

Debian Linux by Debian

Drupal by Drupal

Drupal by Drupal

Drupal by Drupal

Drupal by Drupal

Fedora by Fedoraproject

Fedora by Fedoraproject

Fedora by Fedoraproject

Fedora by Fedoraproject

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Input Validation Filter

Disable PHAR Deserialization

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities