~ / search / GHSA-9hr3-j9mc-xmq2

GHSA-9hr3-j9mc-xmq2

Path Traversal in com.alibaba.oneagent:one-java-agent-plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-25842

Packages

EcosystemPackageAffectedFixed in
Maven com.alibaba.oneagent:one-java-agent-plugin < 0.0.2 0.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of package `com.alibaba.oneagent:one-java-agent-plugin` are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. `../../evil.exe`). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.

References

External links from the advisory. They lead to third-party sites.