CVE-2024-0406: Archiver Path Traversal vulnerability

The vulnerability is a path traversal flaw in the mholt/archiver package when unpacking tar archives, specifically exploitable via crafted symlinks. I analyzed the tar.go file from the mholt/archiver repository. The Extract method within this file is responsible for reading tar archive entries. It extracts hdr.Name and hdr.Linkname (symlink target) from the archive. These values, which can be controlled by an attacker crafting a malicious tar file, are then passed to a handleFile callback function. The vulnerability arises if this handleFile callback (which is implemented by the user of the archiver library) uses these paths to create files or symlinks on the filesystem without proper sanitization (e.g., resolving and checking if the path is within the intended destination directory). The Extract function is the library's component that directly processes the malicious archive's structure and passes the unsafe path information to the part of the code that will perform the file system write. Therefore, it is a key function that would appear in a runtime profile during exploitation.