Description

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.

Remediation

References

https://github.com/alibaba/one-java-agent/pull/29

https://snyk.io/vuln/SNYK-JAVA-COMALIBABAONEAGENT-2407874

https://github.com/alibaba/one-java-agent/pull/29/commits/359603b63fc6c59d8b57e061c171954bab3433bf

https://github.com/alibaba/one-java-agent/blob/1f399a2299a8a409d15ea6111a7098629b8f1050/one-java-agent-plugin/src/main/java/com/alibaba/oneagent/utils/IOUtils.java

Related Vulnerabilities

CVE-2021-39187 Vulnerability in npm package parse-server

CVE-2021-21234 Vulnerability in maven package eu.hinsch:spring-boot-actuator-logview

CVE-2021-29486 Vulnerability in npm package cumulative-distribution-function

CVE-2014-7191 Vulnerability in npm package qs

CVE-2020-13410 Vulnerability in npm package aedes

Severity

Critical

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Exploit