CyberRota Analysis
AI-GeneratedThe oras-go library prior to version 2.6.2 contains a vulnerability that allows an attacker to exploit hardlink targets, potentially exposing or tampering with sensitive files such as .env, .git/config, and AWS credentials. This could lead to unauthorized access or data leakage, making it critical for organizations using this library to upgrade to version 2.6.2 or later to mitigate the risk. Users managing OCI artifacts should prioritize this update to protect their systems from potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.