TarUtils.untar() creates symbolic links verbatim from TAR entry getLinkName() without validating whether the target is an absolute path. A subsequent file entry in the same archive traverses the symlink, writing to arbitrary server-side locations. Exploitable by any authenticated user with CI Job write access — no admin interaction required.
This is an incomplete fix bypass of CVE-2021-21251 (GHSA-2w6j-wc8c-9mq2): that patch blocked .. path segments but did not address absolute symlink targets.
This issue is analyzed and reported by "Sehwang Kim of AhnLab"
kimboann Analyst
TarUtils.untar() creates symbolic links verbatim from TAR entry getLinkName() without validating whether the target is an absolute path. A subsequent file entry in the same archive traverses the symlink, writing to arbitrary server-side locations. Exploitable by any authenticated user with CI Job write access — no admin interaction required.
This is an incomplete fix bypass of CVE-2021-21251 (GHSA-2w6j-wc8c-9mq2): that patch blocked .. path segments but did not address absolute symlink targets.
This issue is analyzed and reported by "Sehwang Kim of AhnLab"