CVE-2024-24579: Anchore Stereoscope Path Traversal Flaw

CVE-2024-24579 Overview

CVE-2024-24579 is a path traversal vulnerability in Anchore Stereoscope, a Go library used for processing container images and simulating a squash filesystem. Prior to version 0.0.1, attackers can craft a malicious OCI tar archive that, when processed by stereoscope's unarchive functionality, results in arbitrary file writes to paths outside of the intended unarchive temporary directory.

Critical Impact
This path traversal vulnerability enables attackers to write arbitrary files to the filesystem outside the expected extraction directory, potentially leading to remote code execution, system compromise, or data manipulation when processing untrusted container images.

Affected Products

Anchore Stereoscope versions prior to 0.0.1
Applications using github.com/anchore/stereoscope/pkg/file.UntarToDirectory() function
Applications using github.com/anchore/stereoscope/pkg/image/oci.TarballImageProvider struct
Applications using github.com/anchore/stereoscope/pkg/image.Image.Read() function

Discovery Timeline

2024-01-31 - CVE-2024-24579 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24579

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The flaw exists in how stereoscope handles the extraction of OCI tar archives. When processing container images in OCI tar format, the library fails to properly validate and sanitize file paths contained within the archive before writing extracted files to disk.

An attacker can exploit this by embedding malicious path components (such as ../ sequences) within file entries of a crafted OCI tar archive. When stereoscope processes this archive, it follows these unsanitized paths, allowing files to be written outside the designated temporary extraction directory to arbitrary locations on the filesystem.

Root Cause

The root cause lies in insufficient path validation during the tar extraction process. Specifically, the vulnerable functions—UntarToDirectory(), TarballImageProvider, and Image.Read()—do not adequately check whether resolved file paths remain within the intended extraction directory boundary. This allows relative path components in archive entries to escape the extraction directory.

Attack Vector

The attack is network-exploitable without requiring authentication or user interaction. An attacker can exploit this vulnerability by:

Crafting a malicious OCI tar archive containing entries with path traversal sequences (e.g., ../../etc/cron.d/malicious)
Providing this malicious archive to an application that uses stereoscope for container image processing
When the application attempts to extract and process the OCI archive, files are written to attacker-controlled locations on the filesystem

The vulnerability allows writing arbitrary files with the privileges of the process running stereoscope. This can lead to overwriting critical system files, planting malicious scripts for later execution, or establishing persistence mechanisms.

The vulnerability manifests in the tar extraction process within stereoscope's OCI archive handling. When processing archive entries, the library fails to validate that the resolved extraction path remains within the designated temporary directory. Malicious archives can include entries with relative path components that, when resolved during extraction, point to locations outside the intended directory. For detailed technical information, see the GitHub Security Advisory and the patch commit.

Detection Methods for CVE-2024-24579

Indicators of Compromise

Unexpected files appearing in directories outside container image extraction paths
Suspicious file creation events in sensitive system directories (e.g., /etc/, /usr/, /var/)
Container image processing logs showing unusual file paths with ../ sequences
Unexplained modifications to system configuration files or cron jobs

Detection Strategies

Monitor file system write operations during container image processing for path traversal patterns
Implement application-level logging to capture all file paths being extracted from OCI archives
Use file integrity monitoring (FIM) solutions to detect unauthorized file modifications in critical directories
Review stereoscope dependency versions in Go modules (go.mod) to identify vulnerable versions

Monitoring Recommendations

Enable audit logging for file creation events, particularly in system directories
Monitor process activity of applications using stereoscope for suspicious file operations
Implement container image scanning to detect malicious archives before processing
Set up alerts for any file writes outside expected container working directories

How to Mitigate CVE-2024-24579

Immediate Actions Required

Upgrade Anchore Stereoscope to version 0.0.1 or later immediately
Audit applications using stereoscope to identify exposure to untrusted OCI archives
Restrict the sources of container images to trusted registries only
Review file system permissions to limit the impact of potential arbitrary file writes

Patch Information

The vulnerability has been addressed in stereoscope version 0.0.1. The fix is available in commit 09dacab4d9ee65ee8bc7af8ebf4aa7b5aaa36204. Organizations should update their Go dependencies to pull the patched version. Review the official patch commit for implementation details.

Workarounds

Switch from OCI tar archive input to OCI layout format by manually unarchiving the tar archive first
Provide the unarchived directory to stereoscope instead of the tar archive directly
Run stereoscope-based applications in isolated environments with restricted filesystem access
Implement additional path validation at the application level before processing OCI archives

bash

# Workaround: Convert OCI tar archive to OCI layout before processing
# Instead of using the tar archive directly, extract it first
mkdir -p /tmp/oci-layout
tar -xf container-image.tar -C /tmp/oci-layout

# Then provide the extracted directory path to your stereoscope-based application
# This avoids the vulnerable tar extraction code path