15-Year-Old Unpatched Python Vulnerability Potentially Affects Over 350,000 Projects

As many as 350,000 open source projects are believed to be
potentially vulnerable to exploitation as a result of a security
flaw in a Python module that has remained unpatched for 15
years.

The open source repositories span a number of industry
verticals, such as software development, artificial
intelligence/machine learning, web development, media, security, IT
management.

The shortcoming, tracked as CVE-2007-4559^[1]
(CVSS score: 6.8), is rooted in the tarfile module, successful
exploitation of which could lead to code execution from an
arbitrary file write.

“The vulnerability is a path traversal attack in the extract and
extractall functions in the tarfile module that allow an attacker
to overwrite arbitrary files by adding the ‘..’ sequence to
filenames in a TAR archive,” Trellix security researcher Kasimir
Schulz said^[2]
in a writeup.

Originally disclosed in August 2007, the bug has to do with how
a specially crafted tar archive can be leveraged to overwrite
arbitrary files on a target machine simply upon opening the
file.

Put simply, a threat actor can exploit the weakness by uploading
a malicious tarfile in a manner that makes it possible to escape
the directory that a file is intended to be extracted to and
achieve code execution, allowing the adversary to potentially seize
control of a target device.

“Never extract archives from untrusted sources without prior
inspection,” the Python documentation for tarfile reads^[3]. “It is possible that
files are created outside of path, e.g. members that have absolute
filenames starting with ‘/’ or filenames with two dots ‘..’.”

The vulnerability is also reminiscent of a recently disclosed
vulnerability in RARlab’s UnRAR utility (CVE-2022-30333^[4]) that could lead to
remote code execution.

Trellix has further released a custom utility called Creosote^[5]
to scan for projects vulnerable to CVE-2007-4559, using it to
uncover the vulnerability in the Spyder Python IDE as well as
Polemarch.

“Left unchecked, this vulnerability has been unintentionally
added to hundreds of thousands of open- and closed-source projects
worldwide, creating a substantial software supply chain attack
surface,” Douglas McKee noted^[6].