Vulnerability · Published Feb 5, 2024 · Assigned by GitHub_M

CVE-2023-52138Path traversal via crafted cpio archives in Engrampa archivers

High 8.2

In plain English

A high-severity security flaw in engrampa from mate-desktop. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)1.7%top 23.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives, the Engrampa Archive manager follows symlink, cpio by default will follow stored symlinks while extracting and the Archiver will not check the symlink location, which leads to arbitrary file writes to unintended locations. When the victim extracts the archive, the attacker can craft a malicious cpio or ISO archive to achieve RCE on the target system. This vulnerability was fixed in commit 63d5dfa.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	engrampa	1.26.0-1+deb12u2	DEBIAN-CVE-2023-52138
Debian:12	engrampa	1.26.0-1+deb12u2	DSA-5625-1
Debian:13	engrampa	1.26.2-1	DEBIAN-CVE-2023-52138
Debian:14	engrampa	1.26.2-1	DEBIAN-CVE-2023-52138

Affected products (as reported)

Vendor	Product	Versions
mate-desktop	engrampa	< commit 63d5dfa

Weakness: CWE-25 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References