Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-56514

CVE-2024-56514: Karmada Tar Slips in CRDs archive extraction

5.3

CVSS Score
4.0

Basic Information

CVE ID
CVE-2024-56514
GHSA ID
GHSA-cwrh-575j-8vr3
EPSS Score
0.44797%
CWE
CWE-22
Published
1/3/2025
Updated
1/3/2025
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/karmada-io/karmadago< 1.12.01.12.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure tar extraction in two components:

  1. In karmadactl's prepareCRD function, CRD tarballs were decompressed using utils.DeCompress() without validating file paths, making it susceptible to directory traversal attacks. The patch added validation.ValidateTarball() before extraction.
  2. In karmada-operator's runUnpack function, CRD tarballs were unpacked with util.Unpack() without path validation. The fix introduced validation checks before unpacking. Both functions lacked path sanitization and allowed '../' sequences in tar entries to escape the target directory, leading to arbitrary file writes. The confidence is high as the patches directly address these functions by adding validation logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t _W**t kin* o* vuln*r**ility is it? W*o is imp**t**?_ *ot* in k*rm****tl *n* k*rm***-op*r*tor, it is possi*l* to supply * *il*syst*m p*t*, or *n *TTP(s) URL to r*tri*v* t** *ustom r*sour** ***initions(*R*s) n***** *y k*rm***. T** *R*s *r*

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* t*r *xtr**tion in two *ompon*nts: *. In k*rm****tl's pr*p*r**R* *un*tion, *R* t*r**lls w*r* ***ompr*ss** usin* utils.***ompr*ss() wit*out v*li**tin* *il* p*t*s, m*kin* it sus**pti*l* to *ir**tory tr*v*rs*l *tt**k