{"id":"GHSA-h9mw-grgx-2fhf","summary":"sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)","details":"### Impact\n\nGiven specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. The follow is an example of a malicious entry:\n\n```\n+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\nThis would have a potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks - https://github.com/search?q=IO.unzip+language%3AScala&type=code&l=Scala&p=1\n\n### Patches\n\nThe problem has been patched in https://github.com/sbt/io/pull/360\nsbt 1.9.7 is available with the fix.\n\n### Workarounds\nA workaround might be use some other library to unzip.\n\n### References\n\n- https://github.com/snyk/zip-slip-vulnerability\n- https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31680\n- https://github.com/sbt/io/issues/358","aliases":["CVE-2023-46122"],"modified":"2023-11-10T05:28:44.063827Z","published":"2023-10-24T01:51:04Z","database_specific":{"nvd_published_at":"2023-10-23T16:15:09Z","cwe_ids":["CWE-22"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2023-10-24T01:51:04Z"},"references":[{"type":"WEB","url":"https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46122"},{"type":"WEB","url":"https://github.com/sbt/io/issues/358"},{"type":"WEB","url":"https://github.com/sbt/io/pull/360"},{"type":"WEB","url":"https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a"},{"type":"PACKAGE","url":"https://github.com/sbt/sbt"}],"affected":[{"package":{"name":"org.scala-sbt:sbt","ecosystem":"Maven","purl":"pkg:maven/org.scala-sbt/sbt"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.4"},{"fixed":"1.9.7"}]}],"versions":["0.99.2","0.99.4","1.0.0","1.0.0-M1","1.0.0-M2","1.0.0-M3","1.0.0-M4","1.0.0-M5","1.0.0-M6","1.0.0-RC1","1.0.0-RC2","1.0.0-RC3","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.0-M1","1.1.0-RC1","1.1.0-RC2","1.1.0-RC3","1.1.0-RC4","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.2.0-M1","1.2.0-RC1","1.2.0-RC2","1.2.0-RC3","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.3.0","1.3.0-M1","1.3.0-M2","1.3.0-M3","1.3.0-M4","1.3.0-M5","1.3.0-M5-94d5ec","1.3.0-RC1","1.3.0-RC2","1.3.0-RC3","1.3.0-RC4","1.3.0-RC5","1.3.1","1.3.10","1.3.11","1.3.12","1.3.13","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.0-M1","1.4.0-M2","1.4.0-RC1","1.4.0-RC2","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.0-M1","1.5.0-M2","1.5.0-RC1","1.5.0-RC2","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.6.0","1.6.0-M1","1.6.0-RC1","1.6.0-RC2","1.6.1","1.6.2","1.7.0","1.7.0-M1","1.7.0-M2","1.7.0-M2-6810fix","1.7.0-M3","1.7.0-RC1","1.7.0-RC2","1.7.1","1.7.2","1.7.3","1.8.0","1.8.0-RC1","1.8.1","1.8.2","1.8.3","1.9.0","1.9.0-M1","1.9.0-RC1","1.9.0-RC2","1.9.0-RC3","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-h9mw-grgx-2fhf/GHSA-h9mw-grgx-2fhf.json"}},{"package":{"name":"org.scala-sbt:io_2.12","ecosystem":"Maven","purl":"pkg:maven/org.scala-sbt/io_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.9.7"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.1.0","1.1.1","1.1.10","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.0-M1","1.2.0-M2","1.2.1","1.2.2","1.3.0","1.3.0-M1","1.3.0-M10","1.3.0-M11","1.3.0-M12","1.3.0-M13","1.3.0-M14","1.3.0-M15","1.3.0-M16","1.3.0-M17","1.3.0-M18","1.3.0-M2","1.3.0-M3","1.3.0-M4","1.3.0-M5","1.3.0-M6","1.3.0-M7","1.3.0-M8","1.3.0-M9","1.3.1","1.3.2","1.3.3","1.3.4","1.4.0","1.4.0-M1","1.4.0-M2","1.4.0-M3","1.4.0-M4","1.4.0-M5","1.4.0-M6","1.4.0-M7","1.4.0-M8","1.5.0","1.5.0-M1","1.5.1","1.6.0","1.6.0-M1","1.6.0-M2","1.7.0","1.8.0","1.8.1","1.9.0","1.9.0-M1","1.9.0-RC3","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-h9mw-grgx-2fhf/GHSA-h9mw-grgx-2fhf.json"}},{"package":{"name":"org.scala-sbt:io_2.13","ecosystem":"Maven","purl":"pkg:maven/org.scala-sbt/io_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.9.7"}]}],"versions":["1.3.0","1.3.0-M11","1.3.0-M12","1.3.0-M13","1.3.0-M14","1.3.0-M15","1.3.0-M16","1.3.0-M17","1.3.0-M18","1.3.1","1.3.2","1.3.3","1.3.4","1.4.0","1.4.0-M1","1.4.0-M2","1.4.0-M3","1.4.0-M4","1.4.0-M5","1.4.0-M6","1.4.0-M7","1.4.0-M8","1.5.0","1.5.0-M1","1.5.1","1.6.0","1.6.0-M1","1.6.0-M2","1.7.0","1.8.0","1.8.1","1.9.0","1.9.0-M1","1.9.0-RC3","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-h9mw-grgx-2fhf/GHSA-h9mw-grgx-2fhf.json"}},{"package":{"name":"org.scala-sbt:io_3","ecosystem":"Maven","purl":"pkg:maven/org.scala-sbt/io_3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.9.7"}]}],"versions":["1.6.0","1.6.0-M2","1.7.0","1.8.0","1.8.1","1.9.0","1.9.0-M1","1.9.0-RC3","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-h9mw-grgx-2fhf/GHSA-h9mw-grgx-2fhf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"}]}