CVE-2024-12718

What it actually does

The vulnerability permits a malicious tar archive to alter file metadata such as modification times using the 'data' filter or change permissions using the 'tar' filter on files located outside the designated extraction directory.

Why it matters to the business

Attackers could tamper with file attributes or permissions across the filesystem, leading to potential integrity issues or unauthorized access modifications without direct code execution.

How an attack unfolds

An attacker crafts a tar file with entries that reference paths outside the extraction target. When a vulnerable Python application extracts it using TarFile.extractall() or extract() with filter='data' or 'tar', the metadata or permissions are applied to files beyond the intended directory.

How to fix it

Upgrade Python to a version containing commit 19de092debb3d7e832e5672cc2f7b788d35951da or later. Avoid using extractall() or extract() with 'data' or 'tar' filters on untrusted archives.

How to confirm the fix worked

Verify Python version is updated and test extraction of crafted archives to confirm no external modifications occur. Check for the presence of the fix commit in the source.

Typical attack path

1. Craft malicious tar archive with out-of-bounds path references
2. Deliver archive to application using vulnerable extraction
3. Trigger extraction with affected filter parameter
4. Observe metadata or permission changes on external files

How to detect it

Look for log entries indicating extraction of tar files with suspicious paths. Monitor file system for unexpected permission or timestamp changes on files not related to extraction targets.

What your security team should do

• Prioritize updating Python installations to the fixed version
• Review code using tarfile extraction filters
• Implement input validation or sandboxing for archive extraction
• Monitor for unusual file metadata changes in logs