Path traversal via archive.extract - CVE 2021-3281 incomplete patch
该报告还没有中文解读。
原文摘录
摘自原文（2076 字符中的一小部分）
While performing a code review on previous vulnerability patches, I found that the fix for the CVE-2021-3281 is incomplete. Just as a reminder, in order to mitigate this vulnerability, the following guard logic has been added in the `extract` function of both `ZipArchive` and `TarArchive` classes …
原文中的代码
# django/django/utils/archive.py
def target_filename(self, to_path, name):
target_path = os.path.abspath(to_path)
filename = os.path.abspath(os.path.join(target_path, name))
if not filename.startswith(target_path):
raise SuspiciousOperation("Archive contains invalid path: '%s'" …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Django 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @stackered · 版权归作者与 Django 所有