CVE-2021-32842

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability.

CVSS v3 4.0 MEDIUM
CVSS v2.0 5.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3	Release Notes Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/	Exploit Third Party Advisory
https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3	Release Notes Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sharpziplib_project:sharpziplib:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-01-26 21:15

Updated : 2024-11-21 06:07

NVD link : CVE-2021-32842

Mitre link : CVE-2021-32842

CVE.ORG link : CVE-2021-32842

JSON object : View

Products Affected

sharpziplib_project

sharpziplib

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2021-32842", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-01-26T21:15:13.337", "references": [{"url": "https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability."}, {"lang": "es", "value": "SharpZipLib (o #ziplib) es una biblioteca Zip, GZip, Tar y BZip2. A partir de la versi\u00f3n 1.0.0 y versiones anteriores a 1.3.3, fue a\u00f1adida una comprobaci\u00f3n de si el archivo de destino est\u00e1 bajo un directorio de destino. Sin embargo, no es exigido que \"_baseDirectory\" termine en barra. Si el directorio base no termina en barra como \"/home/usuario/dir\" es posible crear un archivo con un nombre que comienza como el directorio de destino un nivel m\u00e1s arriba del directorio, por ejemplo \"/home/usuario/dir.sh\". Debido a las restricciones del nombre del archivo y del directorio de destino, el impacto de la creaci\u00f3n arbitraria de archivos es limitado y depende del caso de uso. La versi\u00f3n 1.3.3 ha corregido esta vulnerabilidad"}], "lastModified": "2024-11-21T06:07:51.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sharpziplib_project:sharpziplib:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40FB39D8-CA1E-4EB7-BA3F-7FA5020D772E", "versionEndExcluding": "1.3.3", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}