Google: path traversal

### Summary The Cuttlefish Host Orchestrator exposes an unauthenticated artifact upload + extract API. A crafted `.tar.gz` or `.zip` writes files to **arbitrary absolute paths outside the extraction directory**, as the OS user the orchestrator runs as — a classic Zip-Slip/Tar-Slip plus symlink-following (tar). No credentials are required at the orchestrator layer. ### Affected endpoints (no auth/authz middleware on either) - `POST /v1/userartifacts/{checksum}` — chunked upload - `POST /v1/userartifacts/{checksum}/:extract` — extract the uploaded `.tar.gz` / `.zip` ### Root cause `frontend/src/host_orchestrator/orchestrator/userartifacts.go` joins the attacker-controlled archive entry name onto the destination directory with **no containment check**, and creates symlink entries verbatim: ```go // untar() target := filepath.Join(dst, header.Name) // attacker-controlled; not validated switch header.Typeflag { case tar.TypeReg: f, _ := os.OpenFile(target, os.O_CREATE|os.O_RDWR, os.FileMode(header.Mode)) // writes anywhere case tar.TypeSymlink: os.Symlink(header.Linkname, target) // plants attacker-chosen symlink } // unzip() extractTo(filepath.Join(dstDir, f.Name), f) // same missing check ``` No `filepath.Clean`+prefix check, `filepath.Rel` containment test, or `..`/absolute/symlink rejection anywhere on `ExtractArtifact → extractFile → untar`/`unzip`. So `../../../../etc/cron.d/x` escapes the root (CWE-22), and a symlink entry (`sneak → /target`) followed by `sneak/file` writes through it to an arbitrary absolute path (CWE-59). ### Proof of concept A benign, deterministic Go test drives the real exported `ExtractArtifact()` over an artifact staged as the upload handler leaves it on disk, and asserts canary files escape the extraction root (all three vectors), exit 0. (Attach `userartifacts_zipslip_poc_test.go` + `poc_run.txt`.) ``` git clone https://github.com/google/android-cuttlefish cd android-cuttlefish && git checkout ac6214c7dd79567b6637bce478ecdcc653e028d5 cd frontend/src/host_orchestrator # drop userartifacts_zipslip_poc_test.go into orchestrator/ GOWORK=off go test ./orchestrator/ -run ZipSlipPoC -v ``` ### Impact Unauthenticated arbitrary file write → RCE (write `~/.ssh/authorized_keys`, a cron/systemd unit, or overwrite a Cuttlefish binary/config the orchestrator later executes). In Cuttlefish-as-a-Service — orchestrator reachable behind the operator / `cvd-remote`, processing user artifacts — this is a remote, unauthenticated, multi-tenant host-compromise primitive. ### Suggested fix (apply to `untar` and `unzip`) ```go rel, err := filepath.Rel(dst, target) if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(os.PathSeparator)) { return fmt.Errorf("archive entry escapes destination: %q", name) } // and skip tar.TypeSymlink entries (or verify the resolved link target stays within dst) ```

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity from

GitHub (reviewed advisory)

Weakness

CWE-22, CWE-59

• github.com/google/android-cuttlefish/security/advisories/GHSA-69ch-cc3g-4mh4
• github.com/google/android-cuttlefish