obs-service-extract_file's outfilename parameter allows to write files outside of package directory

Vulnerability

A relative path traversal vulnerability exists in obs-service-tar_scm, a source service for the Open Build Service. The service fails to sanitize the outfilename parameter, allowing extracted files to be written to arbitrary locations outside the package directory via absolute or relative paths like ../somewhere. This affects SUSE Linux Enterprise Server 15 and openSUSE Factory versions prior to 0.9.2.1537788075.fefaa74 [1].

Exploitation

An attacker with control over a repository can craft a malicious tarball that, when processed by the service, writes files to arbitrary paths on the local machine. For instance, a file could be written to /home/$TARGET_USER/.bashrc, or symlinks could be placed to prepare further attacks. The attacker does not need authentication if the victim triggers the malicious service [1].

Impact

Successful exploitation allows arbitrary file write, potentially leading to code execution or privilege escalation. By writing to a user's .bashrc or other startup scripts, the attacker can execute arbitrary commands. The impact is primarily client-side but could extend to the server side with sufficient effort [1].

Mitigation

The vulnerability is fixed in obs-service-tar_scm version 0.10.5.1551309990.79898c7-3.3.1, released as part of SUSE-SU-2019:0540-1 on March 4, 2019 [1]. Users should update to this version or later. No workarounds are documented.