CVE-2018-1000888

Vulnerability

PEAR Archive_Tar versions 1.4.3 and earlier contain a vulnerability (CWE-502, CWE-915) in the Archive_Tar class. Several file operations such as file_exists, is_file, is_dir, and others use $v_header['filename'] as a parameter without sanitization. When the extract() method is called without a specific prefix path, an attacker can trigger unserialization by crafting a tar file with a filename starting with phar:// pointing to a malicious phar file. This leads to PHP object injection. [1][3]

Exploitation

An attacker needs the ability to provide a crafted tar file to an application using Archive_Tar::extract() without a prefix path. The attacker creates a phar file containing serialized metadata with a desired object (e.g., Archive_Tar) and sets a property like $_temp_tarname to a target file path. Then, a tar archive is created with an entry whose filename is phar://[path_to_malicious_phar_file]. When extract() processes this entry, the phar:// wrapper triggers deserialization of the phar metadata, resulting in object instantiation and property manipulation. In the Archive_Tar destructor, @unlink($this->_temp_tarname) is called, allowing arbitrary file deletion. [1][4]

Impact

Successful exploitation allows an attacker to delete arbitrary files on the system by controlling the $_temp_tarname property. If other classes with useful gadgets (e.g., for remote code execution) are loaded, the impact could escalate to full remote code execution, potentially leading to data deletion or modification. The attacker does not need authentication but requires the ability to upload or submit a tar file to the vulnerable application. [1][3][4]

Mitigation

The vulnerability is fixed in version 1.4.4, which was released on 2018-12-27. The fix, committed in [2], prevents filenames from starting with phar://. Users should upgrade to version 1.4.4 or later. No official workaround is available for earlier versions. This CVE is not listed in the KEV catalog. [1][2]