obs-service-go_modules: arbitrary directory delete

Vulnerability

An improper handling of exceptional conditions vulnerability exists in obs-service-go_modules of openSUSE Factory, affecting versions prior to 0.6.1. The script uses user-controlled command-line arguments outdir and basename without sanitization to construct a path for deletion via shutil.rmtree(). Additionally, if extraction of the provided archive fails (e.g., because it is not a valid archive), the program does not exit and continues to execute the cleanup step, allowing an attacker to trigger deletion of an arbitrary directory by controlling both the archive and the arguments [1].

Exploitation

An attacker who can influence the call to the service (e.g., by submitting a crafted package) can set outdir and basename to point to any directory on the victim's system. By providing a non-archive file that causes libarchive.extract_file() to raise an ArchiveError, the script logs the error but does not exit, then proceeds to delete the directory specified by os.path.join(outdir, basename). No authentication or special privileges beyond the ability to invoke the service are required [1].

Impact

Successful exploitation allows an attacker to delete arbitrary files and directories on the victim's system, potentially leading to denial of service, data loss, or system instability. The attacker gains no code execution or privilege escalation, but the impact can be severe depending on the targeted files [1].

Mitigation

The vulnerability is fixed in obs-service-go_modules version 0.6.1. Users should upgrade to this version or later. No workaround is available for earlier versions [1].