CVE-2024-47515

What it actually does

Path traversal via symbolic link support during repository archiving allows an authenticated attacker to read arbitrary local files on the server.

Why it matters to the business

Attackers with repository access can exfiltrate sensitive configuration files, source code, or credentials stored on the host, leading to further compromise or data leakage.

How an attack unfolds

An attacker with a low-privileged account creates a repository containing symbolic links that point outside the archive root, then triggers the archiving function to cause the server to follow the links and include target files in the resulting archive.

How to fix it

Upgrade affected bundler packages to version 2.1.4-1 or later on Ubuntu 20.04 LTS systems; disable symbolic link support in repository archiving if an immediate upgrade is not possible.

How to confirm the fix worked

Verify the installed bundler version is at least 2.1.4-1 and test that archive exports no longer follow or include symlinks pointing outside the repository directory.

Typical attack path

1. Obtain a low-privileged account on the Pagure instance
2. Create or modify a repository to include symbolic links pointing to sensitive local paths
3. Invoke the repository archive export feature
4. Download the resulting archive containing the disclosed files

How to detect it

Search web server and application logs for archive export requests that reference repositories containing symlink entries; inspect generated archive files for unexpected paths or permissions.

What your security team should do

• Apply the fixed bundler version 2.1.4-1 immediately on all Ubuntu 20.04 LTS hosts running Pagure
• Review and restrict repository archiving permissions to trusted users only
• Monitor for unusual archive export activity from low-privileged accounts