Autolab tar slip in Install Assessment functionality (`GHSL-2023-081`)
概要
Autolab tar slip in Install Assessment functionality (GHSL-2023-081)
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Using the install assessment functionality an attacker can feed a Tar file that contain files with paths pointing outside of the target directory (e.g., ../../../../tmp/tarslipped1.sh). When the Install assessment form is submitted the files inside of the archives are expanded to the attacker-chosen locations. This issue has been addressed in version 2.11.0. Users are advised to upgrade.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory securitylab.github.com
- patch github.com