CVE-2023-37460 : What You Need to Know

Plexis Archiver is a collection of Plexus components used to create and extract archives. However, versions prior to 4.8.0 are vulnerable to an arbitrary file creation and potential remote code execution issue. Learn more about this CVE below.

Understanding CVE-2023-37460

Plexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiver.

What is CVE-2023-37460?

Plexus Archiver, specifically using AbstractUnArchiver for extracting archives, prior to version 4.8.0, may allow the creation of arbitrary files and potentially enable remote code execution. This vulnerability arises when attempting to extract an archive containing an entry that already exists in the destination directory as a symbolic link without an existing target.

The Impact of CVE-2023-37460

The vulnerability in Plexus Archiver versions prior to 4.8.0 could be exploited by malicious actors to create arbitrary files and potentially execute remote code, posing significant risks to affected systems.

Technical Details of CVE-2023-37460

Plexus Archiver vulnerability details:

Vulnerability Description

When using AbstractUnArchiver to extract an archive, the vulnerability allows for arbitrary file creation and potential remote code execution.

Affected Systems and Versions

Vendor: codehaus-plexus
Product: plexus-archiver
Vulnerable Versions: < 4.8.0

Exploitation Mechanism

The vulnerability occurs when extracting an archive with an entry that exists in the destination directory as a symbolic link without a target. The issue lies in the

resolveFile()

and

Files.newOutputStream()

functions.

Mitigation and Prevention

Understanding how to mitigate and prevent CVE-2023-37460:

Immediate Steps to Take

Users are advised to update to version 4.8.0 of Plexus Archiver to address this vulnerability. Avoid extracting untrusted archives using vulnerable versions.

Long-Term Security Practices

Regularly update software components and libraries to the latest secure versions. Practice caution when handling archives from untrusted sources.

Patching and Updates

Ensure timely application of patches and updates to mitigate known vulnerabilities.