Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1yODg3LWdmeGgtbTlycs4AAxfQ

mrpack-install vulnerable to path traversal with dependency

Impact

Importing a malicious .mrpack file can cause path traversal while downloading files.
This can lead to scripts or config files being placed or replaced at arbitrary locations, without the user noticing.

Patches

No patches yet.

Workarounds

Avoid importing .mrpack files from untrusted sources.

References

https://docs.modrinth.com/docs/modpacks/format_definition/#files

Permalink: https://github.com/advisories/GHSA-r887-gfxh-m9rr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yODg3LWdmeGgtbTlycs4AAxfQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: 6 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-r887-gfxh-m9rr, CVE-2023-25307
References:

• https://github.com/nothub/mrpack-install/security/advisories/GHSA-r887-gfxh-m9rr
• https://github.com/nothub/mrpack-install/commit/a1f424b6a616d2de95228781eef3b92b9769f23c
• https://github.com/nothub/mrpack-install/releases/tag/v0.16.3
• https://nvd.nist.gov/vuln/detail/CVE-2023-25307
• https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities/
• https://github.com/advisories/GHSA-r887-gfxh-m9rr

Repository: https://github.com/nothub/mrpack-install
Blast Radius: 1.0

Affected Packages