Fedora Repository 归档提取路径遍历漏洞

该路径遍历漏洞允许经过身份验证的远程攻击者上传精心构造的压缩包，该压缩包会在提取时将任意 JSP 文件提取到可以被未经身份验证的 GET 请求执行的位置。攻击者可以利用此漏洞在服务器上执行任意代码，从而完全控制受影响的系统。攻击者可能能够窃取敏感数据，安装恶意软件，或进行进一步的攻击。

Organizations and individuals utilizing older, unmaintained versions of Fedora Repository (0–3.8.1) are at significant risk. This includes those relying on Fedora Repository for managing software packages or repositories, particularly in environments where authentication is not adequately secured or input validation is lacking. Shared hosting environments using vulnerable Fedora Repository instances are also particularly vulnerable.

• linux / server: Monitor repository logs for unusual file extraction patterns or attempts to access unexpected directories. Use lsof or ss to identify any unexpected processes accessing JSP files.

lsof /path/to/repository/jsp_directory

• generic web: Check access logs for GET requests targeting JSP files in unexpected locations.

grep "/jsp_directory/" /var/log/apache2/access.log

• java: Examine the Fedora Repository application code for insecure archive extraction routines. Look for code that doesn't properly validate file paths during extraction.

1. 2015-06-11Patch

   release

2. 2025-01-23Disclosure

   disclosure

1. 已保留2025-01-09
2. 发布日期2025-01-23
3. 修改日期2025-02-06
4. EPSS 更新日期2026-04-02

由于 Fedora Repository 3.8.1 已经停止维护，直接升级是最佳解决方案。建议尽快升级至 6.5.1 版本。如果无法立即升级，可以考虑使用 Web 应用防火墙 (WAF) 或代理服务器来过滤上传的压缩包，阻止包含恶意 JSP 文件的文件上传。此外，应审查并强化 Fedora Repository 的文件上传验证机制，确保上传的文件类型和路径是安全的。