Multiple vulnerabilities through filename manipulation in Archive_Tar
CVE-2020-28949 has a selected CVSS score of 7.8 (high); EIP currently links 1 catalogued exploit, 2 repository PoCs, and 1 lab environment. CISA lists CVE-2020-28949 in KEV; VulnCheck reports CVE-2020-28949 use in known ransomware campaigns.
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 7, 2025 · Source: CVE List
| Product | Source | Version range | Status |
|---|---|---|---|
Archive_TarBrowse PEAR / Archive_Tar | CISA | Version data not supplied | |
pear/archive_tarBrowse Packagist / pear/archive_tar | GitHub Advisory | Before 1.4.11 · Fixed in 1.4.11 | affected |
A containerized PHP 7.2 Apache web server that accepts tar file uploads, extracts them using the Archive_Tar library, and lists the extracted contents. It provides both a vulnerable and a patched version of the library to demonstrate CVE-2020-28948 and CVE-2020-28949.
README.md:1-50server/Dockerfile:1-10server/Dockerfile-patched:1-13server/uploads/index.php:1-44The README explicitly states it is a PoC for CVE-2020-28948 and CVE-2020-28949, and the server code uses a vulnerable Archive_Tar library to process uploaded tar files, which is the target of the described exploits.
README.md:1-3server/uploads/index.php:2server/uploads/index.php:17-18The PEAR Archive_Tar library used by the upload handler to extract uploaded tar files. The vulnerable version (Tar.php) lacks the phar:// check in _maliciousFilename, while the patched version (Tar-patched.php) includes it.
server/Archive/Tar.php:1-2491server/Archive/Tar-patched.php:1-2491server/uploads/index.php:2Receives uploaded tar files, instantiates Archive_Tar, calls extract() without a path argument, and lists extracted contents. It is the entry point for the exploit.
server/uploads/index.php:1-44The base Docker image providing Apache with PHP 7.2, serving the upload form and handling requests.
server/Dockerfile:1Builds the cve-server image using the vulnerable Archive_Tar library (Tar.php).
server/Dockerfile:1-10Builds the cve-server-patched image, replacing Tar.php with Tar-patched.php which includes the phar:// check.
server/Dockerfile-patched:1-13Provides make targets to build and start both the vulnerable and patched server containers, mapping port 8080 to container port 80.
server/Makefile:1-11Denies all access to the uploads directory except for index.php, protecting extracted files from direct web access.
server/uploads/.htaccess:1-7A sample file in the uploads directory used to demonstrate arbitrary file read after .htaccess deletion.
server/uploads/secret.md:1Supported by supplied evidence
The vulnerable Archive_Tar library (Tar.php) does not check for 'phar://' in filenames, allowing a PHAR deserialization attack when a tar file containing a phar:// filename is extracted. The README describes this as arbitrary file deletion, and the patched version adds the missing check.
server/Archive/Tar.php:1-2491server/Archive/Tar-patched.php:1-2491README.md:19-30Supported by supplied evidence
The vulnerable Archive_Tar library (Tar.php) does not check for 'phar://' in filenames, allowing a PHAR inclusion attack when a tar file containing a phar:// filename is extracted. The README describes this as uploading a shell.php for RCE, and the patched version adds the missing check.
server/Archive/Tar.php:1-2491server/Archive/Tar-patched.php:1-2491README.md:32-42server/Makefile:1-11README.md:19-42README.md:7-9README.md:7-9README.md:21-26README.md:27README.md:28-30README.md:34-36README.md:37-42All visible behavior is confined to the lab's own container. The server extracts uploaded tar files and lists contents, which is the intended vulnerable functionality. The Dockerfiles only expose port 80, install netcat (a common debugging tool), and copy local source code. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the lab target is present.
server/Dockerfile:1-10server/Dockerfile-patched:1-13server/uploads/index.php:1-44server/Makefile:1-11This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.