CVE-2024-21542
HIGHluigi < 3.6.0 - Arbitrary File Write via Archive Extraction
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-21542. PoCs published by L3ster1337.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-21542, demonstrating a Zip Slip vulnerability in the Luigi package. The exploit creates a malicious tar archive with path traversal filenames to achieve arbitrary file write, potentially leading to arbitrary code execution.
Description
Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.
Exploits (1)
This repository contains a functional exploit for CVE-2024-21542, demonstrating a Zip Slip vulnerability in the Luigi package. The exploit creates a malicious tar archive with path traversal filenames to achieve arbitrary file write, potentially leading to arbitrary code execution.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N