[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <13b2d236-d2cd-4c70-9040-328127a0a88e@gmail.com>
Date: Sun, 10 Aug 2025 20:16:24 -0500
From: Jacob Bachmeyer <jcb62281@...il.com>
To: lunbun <lunbun021@...il.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-55188: 7-Zip: Arbitrary file write on
extraction, may lead to code execution
On 8/10/25 19:04, lunbun wrote:
> > What does 7-Zip do if the symlink implies a nonexistent directory?
> > (Example: attack targeting ~/.ssh/authorized_keys is unpacked in
> > ~/Downloads/foo/bar and unpacks a symlink to /proc/self/cwd/../../.ssh
> > which maps to ~/Downloads/.ssh which probably does not exist.)
>
> If a symlink targets a nonexistent directory, the write will fail.
> 7-Zip by default will print an error message, like:
> ```
> ERROR: Cannot open output file : errno=2 : No such file or directory :
> ./malicious_link/file.txt
> ```
>
> This applies similarly to other filesystem errors, like insufficient
> permissions or unwritable directory.
>
> However, 7-Zip by default continues with extraction regardless of the
> error, which is why an attacker can use this "shotgun" strategy. These
> errors, though, would hopefully help notify the user that something
> suspicious is happening.
This at least prevents this from being a "silent" attack in all but the
most targeted scenarios---and in those cases, the attacker probably
already has another way in.
> [...]
>
> > Can the malicious link be silently replaced or does extracting a
> > malicious archive leave links to every directory that the attack hit?
> > (That could at least make cleaning out the attack relatively
> > straightforward.)
>
> I could be wrong, but I don't think there is any way for an attacker
> to silently remove or replace a malicious link.
If the link cannot be overwritten (another entry in the fake archive
with the same name?), then there are immediate indications pointing to
everything the attacker planted.
Thank you for answering all of my questions.
> I don't know what the general policy is for releasing exploit PoCs
> after a patch is released. If it is okay, I can post one on this
> thread (publicly) so you can play around with it.
At the original announcement, you had basically released a PoC, there
would be only a matter of programming to generate malicious fake archives.
-- Jacob
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
