- Reported
-
- Issued
-
- Package
-
nix-nar
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#path-traversal
#directory-traversal
#symlink
#arbitrary-file-write
#nar
- References
-
- CVSS Score
- 7.5
HIGH
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality Impact
- None
- Integrity Impact
- High
- Availability Impact
- None
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Patched
-
- Affected Functions
- Version
nix_nar::Decoder::unpack-
Description
Decoder::unpack does not safely contain the paths it extracts, so a malicious NAR
archive can create files outside the destination directory — a path traversal
(CWE-22).
In src/dec.rs (Decoder::unpack):
- A symlink entry's target is written without checking where it points
(
src/dec.rs:153), so the archive can create a symlink that escapes the
destination directory.
- The out-of-destination containment check compares path strings only and does
not account for symlinks created earlier in the same unpack
(
src/dec.rs:176-181), before reaching the write sinks
(std::fs::create_dir at src/dec.rs:201 and OpenOptions::open at
src/dec.rs:218).
- The parser also accepts entry names containing
/ (src/parser.rs:138-147).
Combined, a malicious archive can include a symlink a pointing at an external
directory and then an entry named a/b, causing b to be written to
<external>/b, outside the destination. This can create new files anywhere the
process can write (it cannot overwrite existing files), which is escalatable to code
execution by planting files in attacker-chosen locations.
Advisory available under CC0-1.0
license.