CVE-2020-28949
PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
Description
CVE-2020-28949 is a deserialization of untrusted data vulnerability in PEAR Archive_Tar that allows an attacker to perform an unserialization attack by exploiting case-sensitive blocking of the phar:// stream wrapper. While the library blocks lowercase "phar:" URIs, it fails to block uppercase variants such as "PHAR:", enabling attackers to trigger PHP object deserialization through crafted tar archive filenames. PEAR Archive_Tar is widely used in PHP ecosystems, with known usage in Drupal Core and Red Hat Linux. CISA has added CVE-2020-28949 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 93.0% (99th percentile), exploitation is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| php | archive tar | < 1.4.12 |
| debian | debian linux | 9.0; 10.0 |
| fedoraproject | fedora | 32; 33; 34; 35 |
| drupal | drupal | >= 7.0, < 7.75; >= 8.0.0, < 8.9.10; >= 8.8.0, < 8.8.12; >= 9.0.0, < 9.0.9 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/pear/Archive_Tar/issues/33(Exploit, Issue Tracking, Vendor Advisory)
- https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP/(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/(Mailing List, Third Party Advisory)
- https://security.gentoo.org/glsa/202101-23(Third Party Advisory)
- https://www.debian.org/security/2020/dsa-4817(Mailing List, Third Party Advisory)
- https://www.drupal.org/sa-core-2020-013(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-28949(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2020-28949 exploits a deserialization of untrusted data weakness in PEAR Archive_Tar, where the case-sensitive blocking of the phar:// PHP stream wrapper can be bypassed using uppercase variants. When a tar archive contains filenames using the PHAR:// scheme, the Archive_Tar library processes them through PHP's phar stream handler, which automatically deserializes the phar metadata — an operation that can execute arbitrary code if the deserialized data contains malicious PHP objects.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2020-28949 poses a critical risk to PHP applications that process tar archives using PEAR Archive_Tar. The vulnerability can be exploited remotely by providing a crafted tar archive to any application that extracts or processes tar files. No authentication is required, and the attack complexity is low. Successful exploitation triggers PHP object deserialization, which can lead to arbitrary code execution on the server. In the context of CMS platforms like Drupal that use Archive_Tar, this enables complete website and server compromise, access to database credentials and user data, deployment of web shells for persistent access, and lateral movement within the hosting infrastructure. With an EPSS score of 93.0% (99th percentile), this vulnerability is among the most actively exploited across all known CVEs, reflecting both the simplicity of exploitation and the widespread deployment of affected software.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2020-28949 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 15, 2022. The EPSS score of 93.0% (99th percentile) reflects near-certain exploitation activity. The bypass technique is trivially simple — changing "phar:" to "PHAR:" circumvents the security filter — and public exploit information is widely available. The vulnerability was addressed in Drupal Core via security advisory SA-CORE-2020-013, and Red Hat has released corresponding updates. No specific ransomware campaigns are currently associated with this CVE, but PHP deserialization attacks are commonly used for web server compromise.
Remediation
- Update PEAR Archive_Tar to the patched version: Per the CISA KEV required action, apply updates per vendor instructions. Update Archive_Tar to a version that implements case-insensitive blocking of the phar:// stream wrapper.
- Update Drupal Core if applicable: For Drupal installations, apply the security update referenced in Drupal advisory SA-CORE-2020-013, which patches this vulnerability.
- Apply Red Hat security updates: For Red Hat Linux systems, install the security updates that address CVE-2020-28949 in the bundled Archive_Tar package.
- Disable PHP phar stream wrapper if not needed: In the PHP configuration (php.ini), consider disabling the phar stream wrapper entirely if your application does not require phar archive support, by setting allow_url_fopen appropriately and using stream_wrapper_unregister.
- Validate and sanitize tar archive inputs: Implement strict validation of tar archive contents before processing, rejecting archives containing filenames with stream wrapper schemes (phar://, PHAR://, or any case variation).
Technical Details
CVE-2020-28949 is a PHP unserialization vulnerability in PEAR Archive_Tar that arises from a case-sensitivity flaw in the security filter for the phar:// stream wrapper. PHP's phar stream wrapper allows accessing contents of PHP Archive (phar) files using the phar:// scheme. When a filename is processed through the phar stream handler, PHP automatically deserializes the phar metadata, which can trigger __wakeup() and __destruct() magic methods in PHP objects — a well-known vector for arbitrary code execution. Archive_Tar attempted to mitigate this by blocking filenames starting with "phar:", but the check was case-sensitive. An attacker can bypass this filter by using uppercase variants such as "PHAR://malicious.phar" or mixed-case variants. Since PHP's stream wrapper resolution is case-insensitive on most platforms, the uppercase variant is still processed by the phar handler, triggering deserialization. The fix implements case-insensitive comparison for the phar:// scheme blocking.
Frequently Asked Questions
Is CVE-2020-28949 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2020-28949 to the Known Exploited Vulnerabilities catalog. The EPSS score of 93.0% (99th percentile) indicates near-certain exploitation. The bypass technique is trivially simple, requiring only an uppercase change to circumvent the security filter.
What products are affected by CVE-2020-28949?
CVE-2020-28949 affects PEAR Archive_Tar, which is bundled with Drupal Core and Red Hat Linux distributions. Any PHP application using the vulnerable version of Archive_Tar for tar archive processing is potentially affected.
How do I fix CVE-2020-28949?
Update PEAR Archive_Tar to the patched version with case-insensitive phar:// blocking. For Drupal, apply the update from SA-CORE-2020-013. For Red Hat, install the vendor security updates. Consider disabling the PHP phar stream wrapper entirely if not needed.
How severe is CVE-2020-28949?
CVE-2020-28949 is a critical deserialization vulnerability enabling arbitrary code execution through PHP object unserialization. With an EPSS score of 93.0% (99th percentile), it is among the most actively exploited vulnerabilities. The trivial nature of the case-sensitivity bypass makes exploitation accessible to attackers with minimal technical sophistication.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.