Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm

Vulnerability

The vulnerability resides in the obs-service-tar_scm component of the openSUSE Open Build Service (OBS) prior to commit 51a17c553b6ae2598820b7a90fd0c11502a49106. Improper input validation allows attackers to manipulate service parameters, such as filename, extension, and extract, to escape the intended build directory. Versions before this fix are affected. [1]

Exploitation

An attacker can exploit this by crafting a _service file with malicious parameters. For example, setting /tmp/somepkg and txt results in file creation at the attacker-specified absolute path /tmp/somepkg.txt. Additionally, using the extract parameter with a symlink pointing to an arbitrary file (e.g., /etc/passwd) can lead to extraction of that file into the output. The attacker needs the ability to submit or modify service files in an OBS project, typically via the standard project submission process. [1]

Impact

Successful exploitation allows an attacker to read sensitive information from outside the current build source tree (information disclosure) or create files in attacker-controlled locations on the server filesystem. This can lead to unauthorized access to system files or denial of service through file creation in critical directories. [1]

Mitigation

The vulnerability is fixed by updating obs-service-tar_scm to version containing commit 51a17c553b6ae2598820b7a90fd0c11502a49106, available since October 2018. Users should upgrade their OBS installation and ensure the service package is up-to-date. No workarounds are documented for older versions. References suggest that restricting service credentials and validating inputs can reduce risk. [2]