Cloudanix VulnDB

CVE-2018-1000888

High · 8.8

CVSS

8.8

EPSS

19.1%

Published

Dec 28, 2018

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a common PHP library for handling tar files lets attackers delete or change important files on a server simply by supplying a specially made archive.

Exploit Available Chainable
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Remote Code Execution
Component
Library
Class
Deserialization
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Deserialization flaw in Archive_Tar allows a crafted tar archive containing a phar:// path in the filename header to trigger object injection during extract, invoking destructors that perform arbitrary file deletion via unlink or enable gadget-chain RCE when other classes are present.

Why it matters to the business

Attackers can delete or modify critical files on systems processing untrusted tar archives, leading to service disruption, data loss, or full host compromise; the affected PHP component ships in multiple Debian packages, amplifying exposure across web and security tooling deployments.

How an attack unfolds

An attacker crafts a tar file whose filename header contains a phar:// wrapper pointing to a malicious PHAR archive, uploads or supplies it to any code path that calls Archive_Tar->extract without a prefix, and triggers unserialization that loads attacker-controlled objects, resulting in file operations or remote code execution.

How to fix it

Upgrade all affected packages to the fixed versions: suricata on Debian 11/12/13/14 to 1:4.1.5-1 or later; ensure the underlying PEAR Archive_Tar library is at 1.4.4 or newer; disable phar wrappers and apply strict path sanitization on any remaining Archive_Tar usage.

How to confirm the fix worked

Verify installed package versions match or exceed the listed fixed releases; scan source and dependency trees for Archive_Tar <=1.4.3; test extract operations against a known-bad tar containing phar:// references to confirm rejection or safe handling.

Typical attack path

  1. Craft malicious tar archive embedding phar:// path in v_header['filename']
  2. Deliver archive to target application or service that uses Archive_Tar extract
  3. Trigger extraction without a safe prefix directory
  4. Unserialization executes gadget chain from loaded classes
  5. Destructors perform unlink or other file/RCE primitives

How to detect it

Search web and application logs for tar extraction events that reference phar:// paths or unusual filename headers; inspect PHP error logs for unserialize or Archive_Tar destructor activity; review file-system audit trails for unexpected unlink operations on temporary tar names.

  • phar://
  • Archive_Tar
  • @unlink($this->_temp_tarname)
  • v_header['filename']

What your security team should do

  • Immediately update suricata packages on all Debian 11-14 systems to 1:4.1.5-1
  • Inventory all PHP applications and containers for Archive_Tar usage and enforce upgrades
  • Add runtime checks that block phar:// and file:// wrappers in tar processing code
  • Monitor EPSS trend and exploit availability for prioritization of remaining instances

The record

PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called without a specific prefix path, we can trigger unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path. Object injection can be used to trigger destruct in the loaded PHP classes, e.g. the Archive_Tar class itself. With Archive_Tar object injection, arbitrary file deletion can occur because `@unlink($this->_temp_tarname)` is called. If another class with useful gadget is loaded, it may possible to cause remote code execution that can result in files being deleted or possibly modified. This vulnerability appears to have been fixed in 1.4.4.

Affected packages

Ecosystem Package Introduced Fixed
Packagist pear/archive_tar 0 1.4.4
Debian:11 php-pear 0 1:1.10.6+submodules+notgz-1.1
Debian:12 php-pear 0 1:1.10.6+submodules+notgz-1.1
Debian:13 php-pear 0 1:1.10.6+submodules+notgz-1.1
Debian:14 php-pear 0 1:1.10.6+submodules+notgz-1.1
Debian:8 php5 0 5.6.39+dfsg-0+deb8u2
Debian:9 php-pear 0 1:1.10.1+submodules+notgz-9+deb9u1
Ubuntu:16.04:LTS php-pear 0 1:1.10.1+submodules+notgz-6ubuntu0.1
Ubuntu:18.04:LTS php-pear 0 1:1.10.5+submodules+notgz-1ubuntu1.18.04.1
openSUSE:Tumbleweed php7 0 7.4.24-1.1
openSUSE:Tumbleweed php8 0 8.0.11-1.1

Related vulnerabilities