[MESOS-9610] Fetcher vulnerability - escaping from sandbox

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.7.2
• Fix Version/s: 1.7.3, 1.8.0
• Component/s: fetcher
• Labels: bug foundations security-issue vulnerabilities
• Target Version/s: 1.7.3, 1.8.0
• Sprint: Mesos Foundations RI11 Sp 41
• Story Points: 3
• Assignee: Joseph Wu
• Reporter: Mariusz Derela
• Shepherd: Gilbert Song
• Created: 26/Feb/19 02:05
• Updated: 11/Mar/19 17:48
• Resolved: 07/Mar/19 22:47

Description

I have noticed that there is a possibility to exploit fetcher and  overwrite any file on the agent host.

scenario to reproduce:

1) prepare a file with any content and name a file like "../../../etc/test" and archive it. We can use python and zipfile module to achieve that:

>>> import zipfile
>>> zip = zipfile.ZipFile("exploit.zip", "w")
>>> zip.writestr("../../../../../../../../../../../../etc/mariusz_was_here.txt", "some content")
>>> zip.close()

2) prepare a service that will use our artifact (exploit.zip)

3) run service

at the end in /etc we will get our file. As you can imagine there is a lot possibility how we can use it.

 

 

Issue Links

• relates to: MESOS-9646 Look into enabling the libarchive extraction flag ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS by default