-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/argoproj/argo-workflows/v3 | go | >= 3.7.0, < 3.7.5 | 3.7.5 |
| github.com/argoproj/argo-workflows/v3 | go | < 3.6.14 | 3.6.14 |
| github.com/argoproj/argo-workflows | go | <= 2.5.3-rc4 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the untar function in workflow/executor/executor.go. The provided commit 6b92af23f35aed4d4de8b04adcaf19d68f006de1 directly patches this function to fix a ZipSlip vulnerability related to symbolic links. The patch shows that the original code did not properly sanitize the header.Linkname for symbolic links, allowing a symlink to point outside the destination directory. The patch adds validation for the symlink's target. Furthermore, it adds checks before writing regular files (tar.TypeReg) to ensure the file's path does not resolve to a location outside the destination directory via a previously created malicious symlink. The added test case TestUntarMaliciousSymlink confirms the exact attack scenario. Therefore, the untar function is the identified vulnerable function.
untarworkflow/executor/executor.go