3

I have a python based web application running on a linux server,

Is the following flow vulnerable?

  1. HTTP file upload (regular post from browser)
  2. server validates max size before processes the file (before extraction)
  3. file is processed - stored on temporary directory and named randomly (using a GUID as filename)
  4. uploaded file (tar.gz file) is extracted using a new child process (tar working directory is also a temporary directory):

    tar xf <uploaded file path>
    
  5. extracted files are being parsed (simple json files) and then deleted

  • Is the user in control of the filename? Can this be used to execute additional commands? – Dog eat cat world Feb 2 '16 at 8:51
  • 2
    Check for directory traversal sequences (e.g. ../) in the file names before you extract. I've seen several such systems that fail to do this and let you put files in arbitrary directories. Place an executable files (PHP, JSP, etc.) in the web root and get a remote shell. – paj28 Feb 2 '16 at 8:51
  • @Dogeatcatworld no, i'm naming the file with a GUID generated on the server – Jossef Harush Feb 2 '16 at 9:27
  • @paj28, can a file inside a tar traverse outside of it's working directory? i'm extracting inside /tmp/<random generated dir>/ – Jossef Harush Feb 2 '16 at 9:31
  • 1
    @JossefHarush - They certainly can. Your tar program/library may have protection - but many do not, or have had flaws. The best thing to do is to test the library yourself. – paj28 Feb 2 '16 at 10:40
5

As long as you don't execute files contained in that tarball you're on the safe side of the fence.

As you seem to have realized, there is a potential threat (known as a zip bomb) which contains heavily compressed content which, when extracted without size checking, will use a huge amount of space on the disk.

// when you say max size you mean the size of the tar file or the size of the extracted files?

  • 1
    +1 for mentioning zip bombs. This makes checking the size before decompression more or less useless - you have to check during decompression or use ulimit to limit the file size and amount of usable memory. – Steffen Ullrich Feb 2 '16 at 8:32
  • max size before extraction, i'll check about ulimit. Thanks! – Jossef Harush Feb 2 '16 at 8:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.