CVE-2023-25307
📋 TL;DR
CVE-2023-25307 is a directory traversal vulnerability in nothub mrpack-install versions up to v0.16.2 that allows attackers to write files outside the intended extraction directory. This affects users who process untrusted mrpack files with vulnerable versions of the tool. The vulnerability could lead to arbitrary file overwrite or remote code execution.
💻 Affected Systems
- nothub mrpack-install
📦 What is this software?
Mrpack Install by Mrpack Install Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if attacker-controlled files are processed with elevated privileges.
Likely Case
Arbitrary file overwrite in the context of the user running mrpack-install, potentially leading to data corruption or privilege escalation.
If Mitigated
Limited to file writes within user's permissions if proper sandboxing or least privilege principles are followed.
🎯 Exploit Status
Exploitation requires the victim to process a malicious mrpack file. Public proof-of-concept exists in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.16.3 and later
Vendor Advisory: https://github.com/nothub/mrpack-install/security/advisories/GHSA-r887-gfxh-m9rr
Restart Required: No
Instructions:
1. Update mrpack-install to v0.16.3 or later using your package manager. 2. Verify the update was successful by checking the version. 3. No restart required as this is a command-line tool.
🔧 Temporary Workarounds
Validate mrpack files before processing
allOnly process mrpack files from trusted sources and validate file paths before extraction.
Run with restricted permissions
allExecute mrpack-install with minimal privileges and in a sandboxed environment.
🧯 If You Can't Patch
- Discontinue use of mrpack-install for processing untrusted files
- Implement strict input validation and path sanitization in wrapper scripts
🔍 How to Verify
Check if Vulnerable:
Check mrpack-install version: if version <= 0.16.2, system is vulnerable.Check Version:
mrpack-install --versionVerify Fix Applied:
Verify mrpack-install version is >= 0.16.3 and test with known safe mrpack files.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside expected directories
- Processing of mrpack files with suspicious path patterns
Network Indicators:
- Downloads of mrpack files from untrusted sources
SIEM Query:
Process execution where command contains 'mrpack-install' AND version <= 0.16.2🔗 References
- https://github.com/nothub/mrpack-install/security/advisories/GHSA-r887-gfxh-m9rr
- https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities/
- https://github.com/nothub/mrpack-install/security/advisories/GHSA-r887-gfxh-m9rr
- https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities/
