Description
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
devspace devspace
Default version status: unaffected
0 to ≤ 6.3.21affected
pkg:golang/github.com/loft-sh/devspaceReferences
- https://github.com/devspace-sh/devspace/issues/3290 ↗
- https://github.com/devspace-sh/devspace ↗
- https://github.com/devspace-sh/devspace/blob/7f272dcf90653fa9b42bc4347f7f3f9a52b0e8b5/pkg/devspace/sync/tar.go#L68-L82 ↗
- https://github.com/devspace-sh/devspace/blob/7f272dcf90653fa9b42bc4347f7f3f9a52b0e8b5/pkg/devspace/sync/util.go#L9-L11 ↗
- https://www.vulncheck.com/advisories/devspace-through-6.3.21-path-traversal-via-tar-extraction ↗