ZenML Path Traversal Vulnerability in PathMaterializer Class Allowing Arbitrary File Writes

A path traversal vulnerability has been identified in ZenML version 0.83.1 within the PathMaterializer class. The issue arises in the load function, which validates files during the extraction of data.tar.gz archives. The validation process fails to properly detect symbolic and hard links, allowing for arbitrary file writes. This could lead to the execution of arbitrary commands if critical files are overwritten.

Impact

Exploitation of this vulnerability can result in arbitrary file writes. Overwriting important files such as /etc/crontab or ~/.bashrc could enable unauthorized command execution.

Reproduction

The vulnerability can be reproduced by creating a tar.gz file that includes a symbolic link pointing to a file within the extraction directory. When this archive is processed by the ZenML PathMaterializer, the linked file can be overwritten with arbitrary data, demonstrating the path traversal vulnerability.

Remediation

Users can upgrade to ZenML version 0.84.2 or later, where this vulnerability has been fixed.