CVE-2020-36193
📋 TL;DR
This vulnerability in Archive_Tar allows attackers to write files outside the intended extraction directory via directory traversal in symbolic link handling. It affects systems using Archive_Tar 1.4.11 and earlier to process untrusted tar archives. Web applications and systems extracting user-uploaded tar files are particularly vulnerable.
💻 Affected Systems
- Archive_Tar (PEAR package)
📦 What is this software?
Drupal by Drupal
Drupal by Drupal
Drupal by Drupal
Drupal by Drupal
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution by writing malicious files to system directories, potentially leading to complete system compromise.
Likely Case
Arbitrary file write allowing data corruption, privilege escalation, or denial of service by overwriting critical files.
If Mitigated
Limited to file writes within restricted directories if proper sandboxing and file permission controls are implemented.
🎯 Exploit Status
Exploitation requires the ability to provide a malicious tar archive. The vulnerability is similar to CVE-2020-28948 and public exploit code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Archive_Tar 1.4.12 and later
Vendor Advisory: https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916
Restart Required: No
Instructions:
1. Update Archive_Tar package via composer: composer update pear/archive_tar
2. Or manually replace Tar.php with patched version from GitHub
3. Verify version is 1.4.12 or higher
🔧 Temporary Workarounds
Validate archive paths before extraction
allImplement custom validation to check all paths in tar archives before extraction
// PHP example: Validate each entry path
foreach($archive->listContent() as $file) {
if (strpos($file['filename'], '../') !== false) {
throw new Exception('Path traversal detected');
}
}
Use safe extraction directory
linuxExtract archives to isolated directories with restricted permissions
mkdir -p /tmp/safe_extract_$(date +%s)
chmod 700 /tmp/safe_extract_*
🧯 If You Can't Patch
- Disable tar archive processing for untrusted sources
- Implement strict file permission controls on extraction directories
🔍 How to Verify
Check if Vulnerable:
Check Archive_Tar version: php -r "require_once 'Archive/Tar.php'; echo Archive_Tar::API_VERSION;"Check Version:
php -r "require_once 'Archive/Tar.php'; echo 'Archive_Tar version: ' . Archive_Tar::API_VERSION;"Verify Fix Applied:
Verify version is 1.4.12+: php -r "require_once 'Archive/Tar.php'; echo (version_compare(Archive_Tar::API_VERSION, '1.4.12') >= 0) ? 'Patched' : 'Vulnerable';"📡 Detection & Monitoring
Log Indicators:
- Failed file write attempts outside expected directories
- Multiple tar extraction failures
- Unusual file creation patterns in system directories
Network Indicators:
- Large tar file uploads to web applications
- Repeated tar extraction requests
SIEM Query:
source="web_logs" AND (uri_path="*upload*" OR uri_path="*extract*") AND file_extension="tar"🔗 References
- https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916
- https://lists.debian.org/debian-lts-announce/2021/01/msg00018.html
- https://lists.debian.org/debian-lts-announce/2021/04/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/
- https://security.gentoo.org/glsa/202101-23
- https://www.debian.org/security/2021/dsa-4894
- https://www.drupal.org/sa-core-2021-001
- https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916
- https://lists.debian.org/debian-lts-announce/2021/01/msg00018.html
- https://lists.debian.org/debian-lts-announce/2021/04/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/
- https://security.gentoo.org/glsa/202101-23
- https://www.debian.org/security/2021/dsa-4894
- https://www.drupal.org/sa-core-2021-001
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-36193
