Files added to tar with Phar::buildFromIterator have all-access permissions

The core impact of CVE-2020-7063 lies in the potential for unintended file permission changes. When a PHAR archive is created using the vulnerable function, files added to the archive inherit default permissions (0666), regardless of the original file permissions on the system. This means that files extracted from the archive could have broader access than intended, allowing unauthorized users or processes to read, write, or execute them. This is particularly concerning in environments where file permissions are carefully managed to restrict access to sensitive data or critical system files. A malicious actor could craft a PHAR archive containing files with elevated permissions, then distribute it to compromise systems that extract the archive. While not a direct remote code execution vulnerability, it can be a stepping stone for privilege escalation or data exfiltration.

Systems utilizing PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15, and 7.4.x below 7.4.3 are at risk. This includes web hosting environments, particularly shared hosting providers where multiple users may be creating and extracting PHAR archives. Applications that dynamically generate and distribute PHAR archives are also vulnerable.

• linux / server:

find /var/www/html -name '*.phar' -print0 | xargs -0 stat -c '%a %n' | grep '0666' 

• generic web:

curl -I <website_url>/path/to/archive.phar | grep 'Content-Type' # Check for application/zip or application/octet-stream

1. 2020-02-27Disclosure

   disclosure

1. 已保留2020-01-15
2. 发布日期2020-02-27
3. 修改日期2024-09-16
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2020-7063 is to upgrade to a patched version of PHP. Specifically, upgrade to PHP 7.4.3 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. One approach is to carefully review and adjust file permissions after extracting PHAR archives. Another is to avoid using PharData::buildFromIterator() if possible, opting for alternative methods of creating PHAR archives that preserve original file permissions. Web application firewalls (WAFs) might be configured to inspect PHAR archive uploads and block those with suspicious permissions, but this is a less reliable defense. There are no specific Sigma or YARA rules readily available for this vulnerability, as detection relies primarily on identifying the use of the vulnerable function and subsequent permission anomalies.