CVE-2024-47877
📋 TL;DR
CVE-2024-47877 is a path traversal vulnerability in the Extract Go library that allows attackers to create symbolic links outside the intended extraction directory via malicious archives. This affects applications using vulnerable versions of the extract library to process archive files. Attackers could potentially write files to arbitrary locations on the filesystem.
💻 Affected Systems
- extract Go library
📦 What is this software?
Extract by Codeclysm
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file write leading to remote code execution, privilege escalation, or data destruction.
Likely Case
Unauthorized file creation/modification in sensitive directories, potentially leading to data leakage, service disruption, or lateral movement.
If Mitigated
Limited impact if extraction occurs in isolated containers with restricted filesystem permissions and input validation.
🎯 Exploit Status
Exploitation requires only a malicious archive file. No authentication needed if application processes untrusted archives.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.0
Vendor Advisory: https://github.com/codeclysm/extract/security/advisories/GHSA-8rm2-93mq-jqhc
Restart Required: No
Instructions:
1. Update go.mod to require github.com/codeclysm/extract/v4 v4.0.0 or later. 2. Run 'go mod tidy'. 3. Update code to implement new methods in Extractor.FS interface. 4. Rebuild and redeploy application.
🔧 Temporary Workarounds
Extract to isolated directory
allExtract archives to a temporary directory with restricted permissions before processing contents.
mkdir -p /tmp/extract_isolated && chmod 700 /tmp/extract_isolated
Validate archive contents
allScan archive contents for symlinks and suspicious paths before extraction.
Use 'tar -tf archive.tar' or 'unzip -l archive.zip' to list contents
🧯 If You Can't Patch
- Implement strict input validation to reject archives from untrusted sources.
- Run extraction processes in containers with read-only root filesystems and minimal privileges.
🔍 How to Verify
Check if Vulnerable:
Check go.mod for 'github.com/codeclysm/extract' dependency with version <4.0.0.Check Version:
grep 'codeclysm/extract' go.modVerify Fix Applied:
Verify go.mod requires 'github.com/codeclysm/extract/v4 v4.0.0+' and code implements new Extractor.FS methods.📡 Detection & Monitoring
Log Indicators:
- Unexpected file creation outside extraction directory
- Permission denied errors for symlink creation
Network Indicators:
- Large archive uploads followed by unusual file system activity
SIEM Query:
source="application.logs" AND ("symlink" OR "extract" OR "archive") AND ("permission denied" OR "outside directory")