Vulnerability · Published Apr 21, 2023 · Assigned by GitHub_M
CVE-2023-30620Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdb
High 7.5
In plain English
A high-severity path traversal in mindsdb from mindsdb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release `23.2.1.0 `. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | mindsdb | 23.2.1.0 | GHSA-2g5w-29q9-w6hx |
| PyPI | mindsdb | 23.2.1.0 | PYSEC-2023-27 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/mindsdb/mindsdb/security/advisories/GHSA-2g5w-29q9-w6hx x_refsource_CONFIRM
- https://github.com/mindsdb/mindsdb/commit/4419b0f0019c000db390b54d8b9d06e1d3670039 x_refsource_MISC
- https://github.com/mindsdb/mindsdb/releases/tag/v23.2.1.0 x_refsource_MISC