CVE-2020-36193
PEAR Archive_Tar Improper Link Resolution Vulnerability
Description
CVE-2020-36193 is an improper link resolution vulnerability in PEAR Archive_Tar, a PHP library for creating and extracting tar archives, that allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR (PHP Extension and Application Repository) is an open-source framework widely used in PHP ecosystems, with known usage in third-party products including Drupal Core and Red Hat Linux. By crafting a tar archive containing symbolic links that point outside the extraction directory, an attacker can write arbitrary files to the filesystem. CISA has added CVE-2020-36193 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 71.1% (99th percentile), exploitation is highly probable.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| php | archive tar | <= 1.4.11 |
| fedoraproject | fedora | 32; 33; 34; 35 |
| debian | debian linux | 9.0; 10.0 |
| drupal | drupal | >= 7.0, < 7.78; >= 8.9.0, < 8.9.13; >= 9.0.0, < 9.0.11; >= 9.1.0, < 9.1.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916(Patch)
- https://lists.debian.org/debian-lts-announce/2021/01/msg00018.html(Mailing List, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2021/04/msg00007.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/(Broken Link)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2/(Broken Link)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/(Broken Link)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/(Broken Link)
- https://security.gentoo.org/glsa/202101-23(Third Party Advisory)
- https://www.debian.org/security/2021/dsa-4894(Third Party Advisory)
- https://www.drupal.org/sa-core-2021-001(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-36193(US Government Resource)
Weakness Type
CWE-59: Improper Link Resolution Before File Access
CVE-2020-36193 exploits an improper link resolution weakness in PEAR Archive_Tar, where symbolic links within tar archives are not properly validated before file extraction operations. The Tar.php component fails to check whether symbolic links in the archive point to locations outside the intended extraction directory, allowing an attacker to create symbolic links that traverse the directory structure and write files to arbitrary filesystem locations.
Learn more: CWE-59 — Improper Link Resolution Before File Access
Impact Analysis
CVE-2020-36193 poses a significant risk to PHP applications and systems that use PEAR Archive_Tar for processing tar archives. The vulnerability allows an attacker who can supply a crafted tar archive to write arbitrary files anywhere on the filesystem, limited only by the permissions of the PHP process. In web application contexts, this can lead to remote code execution by overwriting PHP files or web-accessible script files, modification of application configuration files, planting of web shells or backdoors, and compromise of underlying system files if the PHP process runs with elevated privileges. The impact is amplified by the widespread use of Archive_Tar in Drupal Core (a major CMS platform) and Red Hat Linux distributions. With an EPSS score of 71.1% (99th percentile), this vulnerability is among the most likely to be exploited across all known CVEs.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2020-36193 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 15, 2022. The EPSS score of 71.1% (99th percentile) reflects very high exploitation probability. The vulnerability was addressed in Drupal Core via security advisory SA-CORE-2021-001, and Red Hat has also released security updates. Public exploit techniques involving crafted tar archives with malicious symbolic links are well-documented. No specific ransomware campaigns are currently associated with this CVE, but arbitrary file write vulnerabilities in web applications are commonly exploited for web shell deployment.
Remediation
- Update PEAR Archive_Tar to the patched version: Per the CISA KEV required action, apply updates per vendor instructions. Update the Archive_Tar package to the version that includes the fix for symbolic link validation.
- Update Drupal Core if applicable: If running Drupal, apply the update referenced in Drupal security advisory SA-CORE-2021-001, which patches the Archive_Tar vulnerability within the Drupal distribution.
- Apply Red Hat security updates: For Red Hat Linux systems, apply the security updates provided by Red Hat that address CVE-2020-36193 in the bundled Archive_Tar package.
- Validate tar archives before extraction: Implement application-level checks to validate tar archive contents before extraction, specifically checking for symbolic links that point outside the intended extraction directory.
- Run PHP processes with minimal privileges: Ensure that PHP processes and web servers run with the minimum filesystem permissions necessary, limiting the impact of arbitrary file write vulnerabilities by restricting what locations the process can write to.
Technical Details
CVE-2020-36193 is a symlink-following vulnerability in the PEAR Archive_Tar library's Tar.php component. When extracting a tar archive, the library processes each entry sequentially, creating files and directories as specified in the archive. The vulnerability exists because the extraction code does not properly validate symbolic link entries before creating them on the filesystem. An attacker can craft a tar archive containing a symbolic link that points to a directory outside the extraction path (e.g., a symlink named "safe_dir" pointing to "/var/www/html/"), followed by a regular file entry that writes through the symlink to the target directory (e.g., "safe_dir/malicious.php"). Because the library creates the symlink without checking its target and then follows it when extracting subsequent files, the attacker achieves arbitrary file write capability. This is a classic Time-of-Check Time-of-Use (TOCTOU) variant where the archive structure itself creates the conditions for directory traversal.
Frequently Asked Questions
Is CVE-2020-36193 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2020-36193 by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 71.1% (99th percentile) indicates very high exploitation probability. The vulnerability affects multiple widely-used products including Drupal Core and Red Hat Linux.
What products are affected by CVE-2020-36193?
CVE-2020-36193 affects PEAR Archive_Tar, a PHP tar archive library. This library is bundled with major products including Drupal Core and Red Hat Linux distributions. Any PHP application using the vulnerable version of Archive_Tar for tar extraction is potentially affected.
How do I fix CVE-2020-36193?
Update PEAR Archive_Tar to the patched version. For Drupal, apply the update from security advisory SA-CORE-2021-001. For Red Hat systems, apply the vendor-provided security updates. Additionally, validate tar archive contents before extraction and run PHP with minimal filesystem privileges.
How severe is CVE-2020-36193?
CVE-2020-36193 is a high severity symlink-following vulnerability that enables arbitrary file write through crafted tar archives. With an EPSS score of 71.1% (99th percentile), it is among the most likely to be exploited. In web application contexts, arbitrary file write often leads to remote code execution through web shell deployment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.