Zip-slip Vulnerability in Apache Karaf Deployers

CVE-2019-0191

Summary

Apache Karaf deployers are susceptible to a file extraction issue when processing .kar archives. The deployer extracts paths from the 'repository/' and 'resources/' entries without validating the directory structure. An attacker can exploit this vulnerability by crafting a malicious .kar file that includes '..' directory traversal sequences, allowing them to write arbitrary content outside of the intended directories. This results in the risk of unauthorized data access or potential system compromise. Versions of Apache Karaf prior to 4.2.3 are affected, especially if the process user has elevated permissions.

References