security.snyk.io Open in urlscan Pro
2a02:26f0:ef:299::ecd  Public Scan

Form analysis
2 forms found in the DOM

<form id="mktoForm_1461" style="display: none; font-family: Helvetica, Arial, sans-serif; font-size: 13px; color: rgb(51, 51, 51); width: 1px;" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft">
  <style type="text/css">
    .mktoForm .mktoButtonWrap.mktoSimple .mktoButton {
      color: #fff;
      border: 1px solid #75ae4c;
      padding: 0.4em 1em;
      font-size: 1em;
      background-color: #99c47c;
      background-image: -webkit-gradient(linear, left top, left bottom, from(#99c47c), to(#75ae4c));
      background-image: -webkit-linear-gradient(top, #99c47c, #75ae4c);
      background-image: -moz-linear-gradient(top, #99c47c, #75ae4c);
      background-image: linear-gradient(to bottom, #99c47c, #75ae4c);
    }

    .mktoForm .mktoButtonWrap.mktoSimple .mktoButton:hover {
      border: 1px solid #447f19;
    }

    .mktoForm .mktoButtonWrap.mktoSimple .mktoButton:focus {
      outline: none;
      border: 1px solid #447f19;
    }

    .mktoForm .mktoButtonWrap.mktoSimple .mktoButton:active {
      background-color: #75ae4c;
      background-image: -webkit-gradient(linear, left top, left bottom, from(#75ae4c), to(#99c47c));
      background-image: -webkit-linear-gradient(top, #75ae4c, #99c47c);
      background-image: -moz-linear-gradient(top, #75ae4c, #99c47c);
      background-image: linear-gradient(to bottom, #75ae4c, #99c47c);
    }
  </style>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoSimple" style="margin-left: 120px;"><button type="submit" class="mktoButton">Submit</button></span></div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor"
    value="1461"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="677-THP-415">
</form>

<form style="display: none; font-family: Helvetica, Arial, sans-serif; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;" novalidate="novalidate"
  class="mktoForm mktoHasWidth mktoLayoutLeft"></form>

Text Content

About Snyk
 1. Snyk Vulnerability Database
 2. Go
 3. github.com/argoproj/argo-events/sensors/artifacts




DIRECTORY TRAVERSAL AFFECTING GITHUB.COM/ARGOPROJ/ARGO-EVENTS/SENSORS/ARTIFACTS
OPEN THIS LINK IN A NEW TAB PACKAGE, VERSIONS <1.7.1

--------------------------------------------------------------------------------

7.5
high


 * ATTACK COMPLEXITY
   
   
   
   Low
   
   


 * CONFIDENTIALITY
   
   
   
   High
   
   

See more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components
are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Directory Traversal vulnerabilities in an interactive lesson.

Start learning


 * SNYK-ID
   
   SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522


 * PUBLISHED
   
   12 Jun 2022


 * DISCLOSED
   
   9 Jun 2022


 * CREDIT
   
   Derek Wang

Report a new vulnerability Found a mistake?

INTRODUCED: 9 JUN 2022

New CVE-2022-25856 Open this link in a new tab

CWE-22 Open this link in a new tab

First added by Snyk
Share



HOW TO FIX?

Upgrade github.com/argoproj/argo-events/sensors/artifacts to version 1.7.1 or
higher.


OVERVIEW

Affected versions of this package are vulnerable to Directory Traversal in the
(g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file
reads if the GitArtifactReader is provided a pathname containing a symbolic link
or an implicit directory name such as ...


DETAILS

A Directory Traversal attack (also known as path traversal) aims to access files
and directories that are stored outside the intended folder. By manipulating
files with "dot-dot-slash (../)" sequences and its variations, or by using
absolute file paths, it may be possible to access arbitrary files and
directories stored on file system, including application source code,
configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

 * Information Disclosure: Allows the attacker to gain information about the
   folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a
vulnerability of this type. In our example, we will serve files from the public
route.

If an attacker requests the following URL from our server, it will in turn leak
the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa


Note %2e is the URL encoded version of . (dot).

 * Writing arbitrary files: Allows the attacker to create or replace existing
   files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path
traversal filenames. When each filename in the zip archive gets concatenated to
the target extraction folder, without validation, the final path ends up outside
of the target folder. If an executable or a configuration file is overwritten
with a file containing malicious code, the problem can turn into an arbitrary
code execution issue quite easily.

The following is an example of a zip archive with one benign file and one
malicious file. Extracting the malicious file will result in traversing out of
the target folder, ending up in /root/.ssh/ overwriting the authorized_keys
file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys



REFERENCES

 * GitHub Commit
 * GitHub Issue


PRODUCT

 * Snyk Open Source
 * Snyk Code
 * Snyk Container
 * Snyk Infrastructure as Code
 * Test with Github
 * Test with CLI


RESOURCES

 * Vulnerability DB
 * Documentation
 * Disclosed Vulnerabilities
 * Blog
 * FAQs


COMPANY

 * About
 * Jobs
 * Contact
 * Policies
 * Do Not Sell My Personal Information


CONTACT US

 * Support
 * Report a new vuln
 * Press Kit
 * Events


FIND US ONLINE

 * 
 * 
 * 
 * 


TRACK OUR DEVELOPMENT

 * 
 * 



© 2022 Snyk Limited

Registered in England and Wales. Company number: 09677925

Registered address: Highlands House, Basingstoke Road, Spencers Wood, Reading,
Berkshire, RG7 1NT.


Submit