15-year-old vulnerability found in Python module

Researchers have discovered a 15-year-old vulnerability found in a Python module and found that hundreds of thousands of repositories are exposed to it.

Trellix Advanced Research Center discovered the vulnerability in Python’s tarfile module, the group revealed yesterday. First, the centre thought it had found a new zero-day vulnerability but then realised it was CVE-2007-4559, a vulnerability first discovered in 2007.

The vulnerability is a path traversal attack in the extract and extractall functions in the tarfile module that allow an attacker to overwrite arbitrary files by adding the “...” sequence to filenames in a TAR archive.

Tarfiles are a collection of multiple different files and metadata which are then used to unarchive the tarfile. The metadata in a tar archive can contain information on its name, size, owner, and when it was archived.

Attackers simply need to add “...” with a separator for the operating system, either “/” or “\”, into the file name to escape the directory the file is meant to be extracted to. The tarfile module also lets users add a filter that can be used to parse and modify a file’s metadata before it’s added to the tar archive. This lets attackers create their exploits with as little as six lines of code.

Throughout its research, Trellix found that hundreds of thousands of repositories were exposed to the vulnerability.

“While the vulnerability was originally only marked as a 6.8, we were able to confirm that in most cases an attacker can gain code execution from the file write,” wrote the centre.

Treliix added that the vulnerability is incredibly easy to exploit, requiring little to no knowledge about complicated security topics. It added that it’s patching as many open-source repositories as possible as well as providing a way to scan closed-source repositories.

Another Python vulnerability was discovered in May this year but in one of its popular open-source packages. Two open-source packages, Python’s CTX and PHP’s phpass, were found to be compromised which led to developers trying to understand their exposure to the vulnerability. Around 3 million users were expected to be affected by the compromise, with one business already reporting it had been affected.