Patchfirst
Patchfirst
CVE-2020-28949 KEVPublic exploit High · 7.8 EPSS 84.6%

PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability

PEAR · Archive_Tar

Summary

The PEAR Archive_Tar library, up to and including version 1.4.10, contains a deserialization flaw in how it handles untrusted archive filenames. Its sanitization of stream-wrapper prefixes (the "://" handling) only defends against phar attacks, leaving other wrappers such as file:// usable. An attacker who can get a user or process to open a crafted archive would need local access and user interaction, and could then overwrite files on the system.

Official description · NVD

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

Breakdown
78.4 / 100
Exploited
Yes, in CISA KEV
Reports
0
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 21 months after disclosure. Public exploit code (Metasploit) was available 2 days before disclosure.

  1. Public exploit codeMetasploit2 days before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidenceAdded to CISA KEVEU database agrees+21 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

5 related vulnerabilities in the same code over 3 years. The latest fix listed for pear/archive_tar is 1.4.14.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2018-1000888PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502…27 Dec 2018
  2. relatedHigh

    Why these are linked:

    • Fixed one release later1.4.4 → 1.4.11 (pear/archive_tar)
    • Same code patched: Tar.php (machine-matched)Functions: _tarRecToSizecommit 59ace12commit 0670a05
    CVE-2020-28948Archive_Tar through 1.4.10 allows an unserialization attack…19 Nov 2020
  3. same family
    This CVECVE-2020-28949PEAR Archive_Tar Deserialization of Untrusted Data19 Nov 2020KEV
  4. Next fix in the same packageHigh

    Why these are linked:

    CVE-2020-36193PEAR Archive_Tar Improper Link Resolution18 Jan 2021KEV
  5. relatedHigh

    Why these are linked:

    CVE-2021-32610In Archive_Tar before 1.4.14, symlinks can refer to targets…27 Jul 2021

Fixes in pear/archive_tarPackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 1.3.2CVE-2006-093128 Feb 2006
  2. 1.4.4CVE-2018-100088827 Dec 2018
  3. 1.4.11CVE-2020-2894819 Nov 2020
  4. 1.4.11CVE-2020-2894919 Nov 2020KEV
  5. 1.4.13CVE-2020-3619318 Jan 2021KEV
  6. 1.4.14CVE-2021-3261027 Jul 2021Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

ExecutionTA0002

Malicious File T1204.002 Medium
AI mapping from the description · how it is exploited

user opens malicious archive; requires user interaction

Archive_Tar through 1.4.10 has :// filename sanitization only
From the official description (NVD) Original (opens in a new tab) ↗

CollectionTA0009

Data from Local System T1005 Medium
AI mapping from the description · primary impact

file:// stream wrapper overwrites arbitrary local files

any other stream-wrapper attack (such as file:// to overwrite files)
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 53 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-28949 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Malicious FileT1204.00239 general rules
All 39 on SigmaHQ ↗
Data from Local SystemT100514 general rules
All 14 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. Main package: pear/archive_tar.

Packagistpear/archive_tarGHSA-75c5-f4gw-38r9

Upgrade to 1.4.14 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2020-36193, CVE-2021-32610).

Set the version to 1.4.14 or later in your composer.json.

First fixed in 1.4.11 for CVE-2020-28949.

Affected versions

If you runUpgrade to
All versions before 1.4.111.4.14first fix for this CVE: 1.4.11

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (1)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

  • Packagistdrupal/core
    Affected: 9.0.0 up to 9.0.9; 8.9.0 up to 8.9.10; 8.0.0 up to 8.8.12Upgrade to 9.0.9 or later (older lines: 8.9.10, 8.8.12)
    DRUPAL-CORE-2020-013

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

13 links, grouped by NVD tag (12 duplicates merged)

Vendor Advisory 1

github.com/pear/Archive_Tar/issues/33

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-28949

Third Party Advisory 11

packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.htmllists.debian.org/debian-lts-announce/2020/11/msg00045.htmllists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/
Show 3 moreShow fewersecurity.gentoo.org/glsa/202101-23debian.org/security/2020/dsa-4817drupal.org/sa-core-2020-013
↑ ↓ chooseEnter openEsc close