CVE-2021-39208

描述

SharpCompress recreates a hierarchy of directories under destinationDirectory if ExtractFullPath is set to true in options. In order to prevent extraction outside the destination directory the destinationFileName path is verified to begin with fullDestinationDirectoryPath. However it is not enforced that fullDestinationDirectoryPath ends with slash: ```csharp public static void WriteEntryToDirectory(IEntry entry, string destinationDirectory, ExtractionOptions? options, Action<string, ExtractionOptions?> write) { string destinationFileName; string file = Path.GetFileName(entry.Key); string fullDestinationDirectoryPath = Path.GetFullPath(destinationDirectory); ... throw new ExtractionException("Entry is trying to write a file outside of the destination directory."); } ``` If the destinationDirectory is not slash terminated like /home/user/dir it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. /home/user/dir.sh. #### Impact Because of the file name and destination directory constraints the arbitrary file creation impact is limited and depends on the use case.

如何修補 CVE-2021-39208

要修補 CVE-2021-39208,請將受影響套件升級到下列已修補版本。

• —升級至 0.29 或更新版本

CVE-2021-39208 正在被利用嗎?

低 — EPSS 為 1.2%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 0.29

CVSS 分數