Description

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.

Remediation

References

https://github.com/alibaba/one-java-agent/blob/1f399a2299a8a409d15ea6111a7098629b8f1050/one-java-agent-plugin/src/main/java/com/alibaba/oneagent/utils/IOUtils.java

https://github.com/alibaba/one-java-agent/pull/29

https://github.com/alibaba/one-java-agent/pull/29/commits/359603b63fc6c59d8b57e061c171954bab3433bf

https://snyk.io/vuln/SNYK-JAVA-COMALIBABAONEAGENT-2407874

Related Vulnerabilities

CVE-2023-46604 Vulnerability in maven package org.apache.activemq:activemq-openwire-legacy

CVE-2020-7639 Vulnerability in npm package eivindfjeldstad-dot

CVE-2020-24750 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2023-46732 Vulnerability in maven package org.xwiki.platform:xwiki-platform-flamingo-skin-resources

CVE-2022-36901 Vulnerability in maven package org.jenkins-ci.plugins:http_request

Severity

Critical

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Patch