CVE-2023-46122 - Vulnerability Details - OpenCVE

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Scala-sbt	Io Sbt

Configuration 1 [-]

OR	cpe:2.3:a:scala-sbt:io::::::sbt::*
	cpe:2.3:a:scala-sbt:sbt::::::::

No data.

References

Link	Providers
https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a
https://github.com/sbt/io/issues/358
https://github.com/sbt/io/pull/360
https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf

History

Wed, 18 Sep 2024 08:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-10-23T15:51:02.875Z

Updated: 2024-09-17T13:45:20.258Z

Reserved: 2023-10-16T17:51:35.571Z

Link: CVE-2023-46122

Vulnrichment

Updated: 2024-08-02T20:37:39.266Z

NVD

Status : Modified

Published: 2023-10-23T16:15:09.383

Modified: 2024-11-21T08:27:55.507

Link: CVE-2023-46122

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-46122", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-10-16T17:51:35.571Z", "datePublished": "2023-10-23T15:51:02.875Z", "dateUpdated": "2024-09-17T13:45:20.258Z"}, "containers": {"cna": {"title": "Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbt", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf"}, {"name": "https://github.com/sbt/io/issues/358", "tags": ["x_refsource_MISC"], "url": "https://github.com/sbt/io/issues/358"}, {"name": "https://github.com/sbt/io/pull/360", "tags": ["x_refsource_MISC"], "url": "https://github.com/sbt/io/pull/360"}, {"name": "https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a", "tags": ["x_refsource_MISC"], "url": "https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a"}], "affected": [{"vendor": "sbt", "product": "sbt", "versions": [{"version": ">= 0.3.4, < 1.9.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-23T15:51:02.875Z"}, "descriptions": [{"lang": "en", "value": "sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7."}], "source": {"advisory": "GHSA-h9mw-grgx-2fhf", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:37:39.266Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf"}, {"name": "https://github.com/sbt/io/issues/358", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/sbt/io/issues/358"}, {"name": "https://github.com/sbt/io/pull/360", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/sbt/io/pull/360"}, {"name": "https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-11T20:11:11.780221Z", "id": "CVE-2023-46122", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-17T13:45:20.258Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf", "name": "https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/sbt/io/issues/358", "name": "https://github.com/sbt/io/issues/358", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/sbt/io/pull/360", "name": "https://github.com/sbt/io/pull/360", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a", "name": "https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:37:39.266Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-46122", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-11T20:11:11.780221Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-17T13:45:17.051Z"}}], "cna": {"title": "Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbt", "source": {"advisory": "GHSA-h9mw-grgx-2fhf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "sbt", "product": "sbt", "versions": [{"status": "affected", "version": ">= 0.3.4, < 1.9.7"}]}], "references": [{"url": "https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf", "name": "https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sbt/io/issues/358", "name": "https://github.com/sbt/io/issues/358", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sbt/io/pull/360", "name": "https://github.com/sbt/io/pull/360", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a", "name": "https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-23T15:51:02.875Z"}}}, "cveMetadata": {"cveId": "CVE-2023-46122", "state": "PUBLISHED", "dateUpdated": "2024-09-17T13:45:20.258Z", "dateReserved": "2023-10-16T17:51:35.571Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-10-23T15:51:02.875Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:scala-sbt:io:*:*:*:*:*:sbt:*:*", "matchCriteriaId": "E26E7679-8BEF-4E54-9908-CD46A514E6CB", "versionEndExcluding": "1.9.7", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:scala-sbt:sbt:*:*:*:*:*:*:*:*", "matchCriteriaId": "5520A3FF-F431-48C6-B5E7-C238800BF059", "versionEndExcluding": "1.9.7", "versionStartIncluding": "0.3.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7."}, {"lang": "es", "value": "sbt es una herramienta de compilaci\u00f3n para Scala, Java y otros. Dado un archivo zip o JAR especialmente manipulado, `IO.unzip` permite escribir archivos arbitrarios. Esto tendr\u00eda potencial para sobrescribir `/root/.ssh/authorized_keys`. Dentro del c\u00f3digo principal de sbt, `IO.unzip` se usa en la tarea `pullRemoteCache` y `Resolvers.remote`; sin embargo, muchos proyectos utilizan `IO.unzip(...)` directamente para implementar tareas personalizadas. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 1.9.7."}], "id": "CVE-2023-46122", "lastModified": "2024-11-21T08:27:55.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-23T16:15:09.383", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/sbt/io/issues/358"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/sbt/io/pull/360"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/sbt/io/issues/358"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/sbt/io/pull/360"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}