Exploitation Summary
CVE-2020-28949 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added August 25, 2022, with confirmed use in ransomware campaigns.
EIP tracks 2 public exploits from researchers including gwillcox-r7, xorathustra, including a Metasploit module exploits/multi/fileformat/archive_tar_arb_file_write.
AI-analyzed exploit summary This repository contains functional exploit code for CVE-2020-28948 and CVE-2020-28949, targeting the Archive_Tar library. The PoC demonstrates PHAR deserialization and inclusion attacks, leading to arbitrary file deletion and remote code execution.
Description
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
Exploits (2)
This repository contains functional exploit code for CVE-2020-28948 and CVE-2020-28949, targeting the Archive_Tar library. The PoC demonstrates PHAR deserialization and inclusion attacks, leading to arbitrary file deletion and remote code execution.
This Metasploit module exploits CVE-2020-28949 in PEAR Archive_Tar <= 1.4.10 by leveraging improper validation of file stream wrappers in filenames to write arbitrary files with user-controlled content. The exploit generates a malicious tar archive containing a file path with a 'file://' wrapper to achieve arbitrary file write.
References (13)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H