CVE-2024-57966

Executive Summary

CVE-2024-57966 is a path traversal vulnerability in KDE Ark, the default archive manager for the KDE Plasma desktop environment. The flaw resides in the libarchiveplugin.cpp file, where the application fails to properly sanitize archive entries containing absolute paths. An attacker can craft a malicious archive (e.g., a .tar, .zip, or .7z file) that, when extracted by a victim using an affected version of Ark, will write files to arbitrary absolute paths on the filesystem. This can lead to overwriting critical system files, planting malicious executables in startup directories, or other forms of local privilege escalation or persistence.

The vulnerability is rated with a CVSS score of 5.0 (Medium), with a local attack vector and low complexity. No public proof-of-concept (PoC) or exploit code has been released as of this analysis. The patch is available in KDE Ark version 24.12.0.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the KDE software distribution. Users who install KDE Ark via their Linux distribution's package manager (e.g., apt, dnf, pacman) are at risk if the package is not updated. Supply chain risk is low, but users should verify they are using a patched version from their distribution's repositories.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Attack Vector (AV): Local (L) – The attacker must have the ability to deliver a malicious archive to the victim's system.
• Attack Complexity (AC): Low (L) – No special conditions are required; the archive can be a standard format.
• Privileges Required (PR): None (N) – The attacker does not need any privileges.
• User Interaction (UI): Required (R) – The victim must extract the archive using Ark.
• Scope (S): Unchanged (U) – The vulnerability does not allow the attacker to affect resources beyond the victim's user context.
• Confidentiality (C): None (N) – No data is directly exposed.
• Integrity (I): High (H) – The attacker can overwrite arbitrary files, potentially compromising system integrity.
• Availability (A): None (N) – No direct denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for file overwrite (e.g., replacing a system binary or a user's shell configuration) makes this a serious concern for desktop users.

Deep Dive & Mechanics

The vulnerability is located in the libarchiveplugin.cpp file of KDE Ark. When extracting an archive, Ark uses the libarchive library to iterate over entries. The vulnerable code does not check whether an entry's path is absolute (e.g., /etc/passwd or C:\Windows\system32\drivers\etc\hosts). Instead, it directly passes the path to the extraction routine, which writes the file to the absolute location.

Technical Flow:

1. User opens a malicious archive in Ark.
2. Ark calls extractArchive() which iterates over entries.
3. For each entry, the path is retrieved via archive_entry_pathname().
4. The path is used directly in a file creation call (e.g., open() or fopen()) without sanitization.
5. If the path is absolute (e.g., /tmp/evil.sh), the file is written to that absolute location.

Impact: An attacker can overwrite any file the user has write access to. This includes:

• User's shell startup scripts (~/.bashrc, ~/.zshrc)
• Desktop autostart files (~/.config/autostart/)
• System files if the user has sudo privileges (e.g., via a cron job or by tricking the user into running a script)

Vulnerable vs. Patched Code

Vulnerable Code (before 24.12.0):

// libarchiveplugin.cpp (simplified)
void extractArchive(Archive *archive) {
    struct archive_entry *entry;
    while (archive_read_next_header(archive, &entry) == ARCHIVE_OK) {
        const char *path = archive_entry_pathname(entry);
        // No path sanitization - absolute paths are used directly
        extractEntry(archive, entry, path);
    }
}

Patched Code (24.12.0 and later):

// libarchiveplugin.cpp (simplified)
void extractArchive(Archive *archive) {
    struct archive_entry *entry;
    while (archive_read_next_header(archive, &entry) == ARCHIVE_OK) {
        const char *path = archive_entry_pathname(entry);
        // Sanitize: reject absolute paths and path traversal sequences
        if (isAbsolutePath(path) || containsPathTraversal(path)) {
            // Log warning and skip entry
            continue;
        }
        extractEntry(archive, entry, path);
    }
}

The patch adds a check to reject entries with absolute paths or path traversal sequences (e.g., ../). This prevents the extraction from writing outside the intended destination directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A victim running KDE Ark < 24.12.0
• Ability to deliver a malicious archive (e.g., via email, download, USB)

Step 1: Craft a Malicious Archive Create a tar archive containing a file with an absolute path. For example, to overwrite the user's .bashrc:

# Create a malicious script
echo 'echo "You have been pwned!" > /tmp/pwned.txt' > evil.sh

# Create a tar archive with an absolute path
tar -cf malicious.tar --transform='s|evil.sh|/home/victim/.bashrc|' evil.sh

Alternatively, for a zip archive:

# Create a zip file with an absolute path
zip malicious.zip /home/victim/.bashrc

(Note: Some zip implementations may strip absolute paths; use --absolute-path if available.)

Step 2: Deliver the Archive Send the archive to the victim via email, a download link, or physical media.

Step 3: Victim Extracts the Archive When the victim opens the archive in Ark and extracts it, the file is written to the absolute path.

Step 4: Trigger the Payload If the overwritten file is a startup script (e.g., .bashrc), the payload executes on the next login.

Blue Team (Detection & Prevention)

Detection:

• Monitor for archive extraction operations that write to unexpected absolute paths.
• Use file integrity monitoring (FIM) to detect changes to critical user files (e.g., .bashrc, .profile).
• Deploy endpoint detection and response (EDR) rules that flag processes (e.g., ark) writing to sensitive locations.

Prevention:

• Update KDE Ark to version 24.12.0 or later.
• Implement application whitelisting to prevent untrusted archives from being extracted.
• Use a sandboxed extraction tool (e.g., firejail) to limit Ark's write permissions.
• Educate users to only extract archives from trusted sources.

Indicators of Compromise (IOCs)

• File System Changes:

  • Unexpected modifications to user startup files (~/.bashrc, ~/.zshrc, ~/.profile)
  • New files in system directories (e.g., /tmp/, /etc/) that were not expected
  • Files with suspicious content in autostart directories (~/.config/autostart/)

• Process Behavior:

  • ark process writing to absolute paths outside the extraction directory
  • Unusual child processes spawned by ark (e.g., shell scripts)

• Network IOCs:

  • Archives downloaded from untrusted sources (e.g., phishing emails, malicious websites)

• Log Entries:

  • Syslog entries showing ark accessing sensitive files
  • Auditd logs showing file writes to unexpected locations by ark

Detection Engineering

YARA Rule

rule CVE_2024_57966_Malicious_Archive {
    meta:
        description = "Detects archives containing absolute paths (CVE-2024-57966)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57966"
    strings:
        $abs_path = /\/[a-zA-Z0-9_\/]+\.[a-zA-Z]{1,5}/  // crude absolute path pattern
        $tar_header = { 75 73 74 61 72 }  // "ustar" in hex
        $zip_header = { 50 4B 03 04 }  // PK\x03\x04
    condition:
        ($tar_header or $zip_header) and #abs_path > 0
}

Sigma Rule

title: CVE-2024-57966 - KDE Ark Absolute Path Extraction
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects KDE Ark extracting files to absolute paths (CVE-2024-57966)
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ark'
        CommandLine|contains: 'extract'
    filter:
        CommandLine|contains: '--destdir'  # legitimate extraction
    condition: selection and not filter
falsepositives:
    - Legitimate extraction to absolute paths (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-57966 - Malicious Archive Download"; flow:to_server,established; content:"|50 4B 03 04|"; depth:4; content:"|2F|"; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Note: This rule detects zip archives containing a forward slash (absolute path indicator) in the first 100 bytes. Adjust for tar archives using the "ustar" magic bytes.

Remediation & Mitigation

Immediate Actions:

1. Update KDE Ark to version 24.12.0 or later. This is the only complete fix.
2. Restrict extraction permissions using AppArmor or SELinux to prevent Ark from writing to sensitive directories.
3. Monitor for exploitation using the provided IOCs and detection rules.

Long-Term Mitigations:

• Implement a security policy that requires all archive extraction tools to sanitize paths.
• Use a dedicated extraction tool (e.g., bsdtar with --no-absolute-paths) for automated extraction.
• Educate users on the risks of extracting archives from untrusted sources.

Workarounds (if patching is not possible):

• Disable automatic extraction of archives in email clients or download managers.
• Use a sandboxed environment (e.g., Docker, Firejail) to extract untrusted archives.

Valters IT
Securing Digital Frontiers