Unarchiving vulnerabilities and avoiding tar-pits
summary
Finds three vulnerabilities in Python's tarfile library including an arbitrary write path traversal that lets a crafted tar overwrite files anywhere it has permission, demonstrated by a tar that replaces authorized_keys and succeeds in the live demo. Exploit chains realpath behavior (tarfile.realpath strict=False), lstat/readlink handling and a PATH_MAX symlink overflow to bypass destination checks. Notes PEP703 filters and that the secure default lands in Python 3.14, and cites ~42% downloads on vulnerable versions.
AI-written summary · about
chapters (9)
- 0:00Archive vulnerabilities
- 2:07Tar file exploits
- 7:22Retrofitting security challenges
- 10:13Python tar vulnerability
- 16:42Leaky abstractions in security
- 19:50Path traversal exploit
- 21:55Software security incentives
- 23:40Exploit demonstration
- 25:48Key takeaways
related talks
41mTARmageddon: Reflections on a Multi-Crate CVE
59mCommon Python Coding Mistakes
28mUnveiling Remote Code Execution: How Vulnerabilities Lead to System Takeovers
26mTesting Python Security
31mA survey of recent RubyGems CVEs
28mpip audit dozens of vulnerabilities after
25m"Security considerations in Python Packaging"
25mUnexpected Execution: Wild Ways Code Execution can Occur in Python