Oras Go
Monthly
Path traversal and arbitrary file write in the oras-go OCI artifact library prior to 2.6.2 allow a malicious artifact layer marked with the io.deis.oras.content.unpack=true annotation to escape the content/file.Store extraction root and create or overwrite any file writable by the pulling process, potentially leading to code execution. Exploitation is unauthenticated from an attacker's network position (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction (UI:R) because the victim must pull the attacker-controlled artifact reference; the bug bypasses the AllowPathTraversalOnWrite=false default, so no permissive configuration is needed. Scored 8.8 High, with no public exploit identified at time of analysis and no CISA KEV listing; a vendor patch is available in oras-go 2.6.2.
Blind server-side request forgery in the oras-go library lets a malicious or compromised OCI registry steer pagination requests to arbitrary internal endpoints chosen by the attacker. Affected are all oras-go versions prior to 2.6.2; the parseLink routine in registry/remote/utils.go accepted an absolute URL from the registry-supplied Link 'rel=next' header without checking scheme, host, or port, so Tags, Referrers, or Repositories listing calls could be pointed at internal services such as the cloud metadata endpoint 169.254.169.254. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), no attacker credentials are needed and the request originates from the victim's network, but exploitation requires the victim to initiate a pagination-based listing against the attacker's registry, response bodies are not returned to the attacker, and only timing/error differences reveal reachability - except when the victim's credential store already holds an entry for the attacker-chosen host, in which case those credentials may be attached. No public exploit code or confirmed in-the-wild activity was identified at time of analysis; the issue is remediated in 2.6.2, and the maintainer treats this report as a duplicate consolidated under an earlier advisory.
Path traversal and arbitrary file write in the oras-go OCI artifact library prior to 2.6.2 allow a malicious artifact layer marked with the io.deis.oras.content.unpack=true annotation to escape the content/file.Store extraction root and create or overwrite any file writable by the pulling process, potentially leading to code execution. Exploitation is unauthenticated from an attacker's network position (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction (UI:R) because the victim must pull the attacker-controlled artifact reference; the bug bypasses the AllowPathTraversalOnWrite=false default, so no permissive configuration is needed. Scored 8.8 High, with no public exploit identified at time of analysis and no CISA KEV listing; a vendor patch is available in oras-go 2.6.2.
Blind server-side request forgery in the oras-go library lets a malicious or compromised OCI registry steer pagination requests to arbitrary internal endpoints chosen by the attacker. Affected are all oras-go versions prior to 2.6.2; the parseLink routine in registry/remote/utils.go accepted an absolute URL from the registry-supplied Link 'rel=next' header without checking scheme, host, or port, so Tags, Referrers, or Repositories listing calls could be pointed at internal services such as the cloud metadata endpoint 169.254.169.254. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), no attacker credentials are needed and the request originates from the victim's network, but exploitation requires the victim to initiate a pagination-based listing against the attacker's registry, response bodies are not returned to the attacker, and only timing/error differences reveal reachability - except when the victim's credential store already holds an entry for the attacker-chosen host, in which case those credentials may be attached. No public exploit code or confirmed in-the-wild activity was identified at time of analysis; the issue is remediated in 2.6.2, and the maintainer treats this report as a duplicate consolidated under an earlier advisory.