Vulnerability · Published Oct 23, 2023 · Assigned by GitHub_M

CVE-2023-46122Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbt

Low 3.9

In plain English

A low-severity path traversal in sbt from sbt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.9Low

Exploit odds (30 days)0.4%top 69.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.scala-sbt:io_2.12	1.9.7	GHSA-h9mw-grgx-2fhf
Maven	org.scala-sbt:io_2.13	1.9.7	GHSA-h9mw-grgx-2fhf
Maven	org.scala-sbt:io_3	1.9.7	GHSA-h9mw-grgx-2fhf
Maven	org.scala-sbt:sbt	1.9.7	GHSA-h9mw-grgx-2fhf

Affected products (as reported)

Vendor	Product	Versions
sbt	sbt	>= 0.3.4, < 1.9.7

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

References

https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf x_refsource_CONFIRM
https://github.com/sbt/io/issues/358 x_refsource_MISC
https://github.com/sbt/io/pull/360 x_refsource_MISC
https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a x_refsource_MISC