Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix
概要
Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com