Deserialization of Untrusted Data in Archive_Tar
CVE-2020-28948 has a selected CVSS score of 7.8 (high); EIP currently links 3 repository PoCs and 2 lab environments.
| Product | Source | Version range | Status |
|---|---|---|---|
pear/archive_tarBrowse Packagist / pear/archive_tar | GitHub Advisory | Before 1.4.11 · Fixed in 1.4.11 | affected |
A Docker Compose environment that builds an Ubuntu 18.04 container with Apache, PHP 7.2, and the PEAR Archive_Tar 1.4.10 package. The container is run in privileged mode with port 80 exposed. Two binary files (Archive_Tar-1.4.10.tgz and exploit.zip) are copied into the image. The README references CVE-2020-28948 and links to a proof-of-concept for CVE-2020-28948 and CVE-2020-28949.
docker-compose.yml:1-12Dockerfile:1-10README.md:1-3The README explicitly names CVE-2020-28948 and links to a proof-of-concept for that CVE and CVE-2020-28949. The Dockerfile installs a specific vulnerable version of Archive_Tar (1.4.10) and copies an exploit.zip into the container, consistent with a vulnerability reproduction or exercise environment.
README.md:1-3Dockerfile:7-9A single service built from the Dockerfile. It runs Apache with PHP 7.2 and the PEAR Archive_Tar 1.4.10 package. The container is started in privileged mode, exposes port 80, and executes a command that restarts Apache then opens an interactive bash shell.
docker-compose.yml:4-12Dockerfile:1-10Insufficient evidence
The README and docker-compose hostname reference CVE-2020-28948, and the Dockerfile installs Archive_Tar 1.4.10, which is plausibly vulnerable. However, no exploit code or vulnerability details are visible in the supplied text; the exploit.zip is binary and uninspected. The association cannot be confirmed or contradicted from the visible evidence alone.
README.md:1-3docker-compose.yml:5Dockerfile:8-9docker-compose.yml:1-12docker-compose.yml:8-9docker-compose.yml:10-12Dockerfile:9The container is run with privileged: true, which grants extensive host access and is a common escape vector. The command opens an interactive bash shell with tty: true, and the exploit.zip binary is uninspected. While these may be intended for the lab exercise, the combination of privileged mode, interactive shell, and an uninspected binary payload raises concrete safety concerns beyond the documented lab target.
docker-compose.yml:8-12Dockerfile:9docker-compose.yml:8docker-compose.yml:10-12Dockerfile:9This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
Packet coverage: 2 binary files not inspected
A containerized PHP 7.2 Apache web server that accepts tar file uploads, extracts them using the Archive_Tar library, and lists the extracted contents. It provides both a vulnerable and a patched version of the library to demonstrate CVE-2020-28948 and CVE-2020-28949.
README.md:1-50server/Dockerfile:1-10server/Dockerfile-patched:1-13server/uploads/index.php:1-44The README explicitly states it is a PoC for CVE-2020-28948 and CVE-2020-28949, and the server code uses a vulnerable Archive_Tar library to process uploaded tar files, which is the target of the described exploits.
README.md:1-3server/uploads/index.php:2server/uploads/index.php:17-18The PEAR Archive_Tar library used by the upload handler to extract uploaded tar files. The vulnerable version (Tar.php) lacks the phar:// check in _maliciousFilename, while the patched version (Tar-patched.php) includes it.
server/Archive/Tar.php:1-2491server/Archive/Tar-patched.php:1-2491server/uploads/index.php:2Receives uploaded tar files, instantiates Archive_Tar, calls extract() without a path argument, and lists extracted contents. It is the entry point for the exploit.
server/uploads/index.php:1-44The base Docker image providing Apache with PHP 7.2, serving the upload form and handling requests.
server/Dockerfile:1Builds the cve-server image using the vulnerable Archive_Tar library (Tar.php).
server/Dockerfile:1-10Builds the cve-server-patched image, replacing Tar.php with Tar-patched.php which includes the phar:// check.
server/Dockerfile-patched:1-13Provides make targets to build and start both the vulnerable and patched server containers, mapping port 8080 to container port 80.
server/Makefile:1-11Denies all access to the uploads directory except for index.php, protecting extracted files from direct web access.
server/uploads/.htaccess:1-7A sample file in the uploads directory used to demonstrate arbitrary file read after .htaccess deletion.
server/uploads/secret.md:1Supported by supplied evidence
The vulnerable Archive_Tar library (Tar.php) does not check for 'phar://' in filenames, allowing a PHAR deserialization attack when a tar file containing a phar:// filename is extracted. The README describes this as arbitrary file deletion, and the patched version adds the missing check.
server/Archive/Tar.php:1-2491server/Archive/Tar-patched.php:1-2491README.md:19-30Supported by supplied evidence
The vulnerable Archive_Tar library (Tar.php) does not check for 'phar://' in filenames, allowing a PHAR inclusion attack when a tar file containing a phar:// filename is extracted. The README describes this as uploading a shell.php for RCE, and the patched version adds the missing check.
server/Archive/Tar.php:1-2491server/Archive/Tar-patched.php:1-2491README.md:32-42server/Makefile:1-11README.md:19-42README.md:7-9README.md:7-9README.md:21-26README.md:27README.md:28-30README.md:34-36README.md:37-42All visible behavior is confined to the lab's own container. The server extracts uploaded tar files and lists contents, which is the intended vulnerable functionality. The Dockerfiles only expose port 80, install netcat (a common debugging tool), and copy local source code. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the lab target is present.
server/Dockerfile:1-10server/Dockerfile-patched:1-13server/uploads/index.php:1-44server/Makefile:1-11This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.