CVE-2020-7667
📋 TL;DR
This vulnerability allows path traversal attacks during CPIO archive extraction in the go-rpmutils library. Attackers can craft malicious archives to write files outside the intended directory, potentially overwriting system files or deploying malware. Any application using the vulnerable go-rpmutils/cpio package to extract untrusted CPIO archives is affected.
💻 Affected Systems
- github.com/sassoftware/go-rpmutils/cpio
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via overwriting critical system files (like /etc/passwd, init scripts) or deploying persistent malware/backdoors.
Likely Case
Arbitrary file write leading to data corruption, privilege escalation, or denial of service by overwriting application files.
If Mitigated
Limited to directory traversal within the extraction process if proper input validation and sandboxing are implemented.
🎯 Exploit Status
Exploitation is straightforward - create a CPIO archive with '..' in file paths. No authentication needed if the application accepts untrusted archives.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.0 and later
Vendor Advisory: https://github.com/sassoftware/go-rpmutils/commit/a64058cf21b8aada501bba923c9aab66fb6febf0
Restart Required: No
Instructions:
1. Update go.mod to require github.com/sassoftware/go-rpmutils/cpio v0.1.0 or later. 2. Run 'go mod tidy'. 3. Rebuild and redeploy your application.
🔧 Temporary Workarounds
Input validation wrapper
allImplement custom extraction logic that sanitizes paths before extraction
// Go code example: Validate path doesn't contain '..' before extraction
Sandbox extraction
linuxExtract archives in isolated containers or chroot environments
docker run --rm -v /tmp/extract:/extract alpine cpio -i -F archive.cpio -D /extract
🧯 If You Can't Patch
- Disable CPIO extraction functionality entirely if not required
- Implement strict access controls to limit who can submit CPIO archives to the application
🔍 How to Verify
Check if Vulnerable:
Check go.mod for 'github.com/sassoftware/go-rpmutils/cpio' version <0.1.0Check Version:
grep 'github.com/sassoftware/go-rpmutils/cpio' go.modVerify Fix Applied:
Verify go.mod requires version >=0.1.0 and check for the fix commit a64058c in dependencies📡 Detection & Monitoring
Log Indicators:
- Unexpected file writes outside extraction directory
- CPIO extraction errors with path traversal attempts
Network Indicators:
- Uploads of CPIO archives to vulnerable endpoints
SIEM Query:
source="application.log" AND "cpio" AND (".." OR "path traversal")🔗 References
- https://github.com/sassoftware/go-rpmutils/commit/a64058cf21b8aada501bba923c9aab66fb6febf0
- https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSASSOFTWAREGORPMUTILSCPIO-570427
- https://github.com/sassoftware/go-rpmutils/commit/a64058cf21b8aada501bba923c9aab66fb6febf0
- https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSASSOFTWAREGORPMUTILSCPIO-570427
