CVE-2023-50255
📋 TL;DR
CVE-2023-50255 is a path traversal vulnerability in Deepin-Compressor, the default archive manager for Deepin Linux OS. When users open specially crafted archive files, attackers can achieve remote command execution on the target system. All Deepin Linux users with vulnerable versions of deepin-compressor are affected.
💻 Affected Systems
- deepin-compressor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root privileges, data theft, ransomware deployment, and persistent backdoor installation.
Likely Case
Local privilege escalation leading to user account compromise, data exfiltration, and lateral movement within the network.
If Mitigated
Limited impact if system runs with minimal privileges, has strict file permissions, and network segmentation prevents lateral movement.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious archive file. The vulnerability is in the archive extraction logic allowing path traversal.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.12.21
Vendor Advisory: https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-rw5r-8p9h-3gp2
Restart Required: No
Instructions:
1. Update package repository: sudo apt update
2. Upgrade deepin-compressor: sudo apt install deepin-compressor
3. Verify version: deepin-compressor --version
🔧 Temporary Workarounds
Disable archive auto-extraction
linuxConfigure system to not automatically extract archives when opened
Use alternative archive manager
linuxInstall and set a different archive manager as default
sudo apt install file-roller
sudo update-alternatives --config x-archive-manager
🧯 If You Can't Patch
- Restrict user privileges to minimize impact if exploited
- Implement application whitelisting to prevent execution of unauthorized binaries
🔍 How to Verify
Check if Vulnerable:
Check deepin-compressor version: deepin-compressor --versionCheck Version:
deepin-compressor --versionVerify Fix Applied:
Verify version is 5.12.21 or higher: deepin-compressor --version | grep -q '5.12.21' && echo 'Patched' || echo 'Vulnerable'📡 Detection & Monitoring
Log Indicators:
- Unusual archive extraction patterns
- Process execution from archive extraction directories
- File writes outside expected extraction paths
Network Indicators:
- Outbound connections from archive manager process
- Unexpected network activity following archive opening
SIEM Query:
process.name:deepin-compressor AND file.path:*../*🔗 References
- https://github.com/linuxdeepin/deepin-compressor/commit/82f668c78c133873f5094cfab6e4eabc0b70e4b6
- https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-rw5r-8p9h-3gp2
- https://github.com/linuxdeepin/deepin-compressor/commit/82f668c78c133873f5094cfab6e4eabc0b70e4b6
- https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-rw5r-8p9h-3gp2
