T09 · Insecure Skill Coding Practices
- Location
scripts/tar.py:9- Finding
Unsafe TAR Extraction Allows Path Traversal and Arbitrary File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
scripts/tar.py, lines 9–10
Vulnerability Type: Unsafe archive extraction
Risk Level: Highpython with tarfile.open(args.file, 'r:*') as t: t.extractall()Technical Analysis
The application extracts every member of a user-supplied TAR archive by calling
tarfile.extractall()without specifying a controlled destination, applying a safe extraction filter, or validating archive member paths and link targets.On Python versions where secure TAR filtering is not the default, a malicious archive can contain absolute paths,
../traversal sequences, or unsafe symbolic or hard-link targets. Such entries can resolve outside the intended extraction directory. Because extraction defaults to the process's current working directory, files outside that directory may be created or overwritten with attacker-controlled content.Attack Path
- An attacker creates a TAR archive containing a member whose name traverses outside the extraction directory, such as
../../target-file. - The attacker supplies the archive to a user or agent, or otherwise influences the archive selected for extraction.
- The user or agent runs:
bash python3 scripts/tar.py -x malicious.tar - The script opens the untrusted archive and passes all members directly to
extractall(). - On an affected Python runtime, the crafted path or unsafe link escapes the current working directory.
- The extraction operation writes attacker-controlled data to a location writable by the invoking account.
Impact Assessment
Successful exploitation allows arbitrary file creation or overwrite with the privileges of the process running the skill. The attacker does not directly gain privileges beyond those of the invoking account, but may modify any file that account can write.
Depending on the execution environment and working directory, affected targets may include application ...[truncated 327 chars]
- An attacker creates a TAR archive containing a member whose name traverses outside the extraction directory, such as
- Remediation
View remediation
Remediation Suggestions
- Extract archives only into an explicit, newly created destination directory.
- On supported Python versions, enable the restrictive data filter:
python from pathlib import Path import tarfile destination = Path("extracted").resolve() destination.mkdir(parents=True, exist_ok=True) with tarfile.open(args.file, "r:*") as archive: archive.extractall(path=destination, filter="data") - For compatibility with runtimes where secure filtering is unavailable or insufficient, validate every member before extraction:
- Reject absolute member paths.
- Resolve each target path and verify that it remains beneath the resolved destination directory.
- Reject
..traversal components. - Reject device files and other special file types.
- Validate symbolic-link and hard-link targets, rejecting links that resolve outside the destination.
- Avoid relying solely on string-prefix checks; use canonical resolved paths and a path-containment operation.
- Document a minimum supported Python version and add automated tests using malicious archives containing absolute paths, traversal entries, and escaping link targets.