CVE-2025-46394: BusyBox TAR Information Disclosure Flaw

CVE-2025-46394 Overview

CVE-2025-46394 is a User Interface Confusion vulnerability in the tar utility within BusyBox through version 1.37.0. The vulnerability allows malicious TAR archives to contain filenames that are hidden from the standard listing output through the strategic use of terminal escape sequences. This deceptive technique can mask malicious files within archives, potentially leading to inadvertent extraction of harmful content.

Critical Impact

Attackers can craft TAR archives with hidden filenames using terminal escape sequences, allowing malicious files to evade visual inspection during archive listing operations.

Affected Products

• BusyBox versions through 1.37.0
• Embedded Linux systems utilizing BusyBox tar functionality
• IoT devices and appliances running vulnerable BusyBox versions

Discovery Timeline

• April 23, 2025 - CVE-2025-46394 published to NVD
• September 24, 2025 - Last updated in NVD database

Technical Details for CVE-2025-46394

Vulnerability Analysis

This vulnerability falls under CWE-451 (User Interface (UI) Misrepresentation of Critical Information). The BusyBox tar implementation fails to properly sanitize or escape terminal control sequences embedded within filenames when displaying archive contents. When a user lists the contents of a malicious TAR archive using tar -t or similar commands, embedded ANSI escape sequences can manipulate the terminal output to hide specific filenames from view.

The attack exploits the trust users place in terminal output when inspecting archive contents before extraction. By carefully crafting escape sequences, an attacker can make malicious files invisible in the listing while they remain fully present and extractable from the archive.

Root Cause

The root cause lies in the insufficient sanitization of filename data when outputting archive contents to the terminal. The BusyBox tar utility does not filter or escape ANSI terminal control characters embedded in TAR entry filenames, allowing these special sequences to manipulate terminal display behavior and hide entries from users.

Attack Vector

This is a local attack vector requiring user interaction. An attacker must craft a malicious TAR archive and deliver it to a target system. The attack succeeds when a user inspects the archive contents via terminal listing commands and then proceeds to extract the archive, unaware of hidden malicious files. The attack chain typically involves:

1. Attacker creates a TAR archive with specially crafted filenames containing terminal escape sequences
2. The archive is distributed to potential victims through various channels
3. Victim lists archive contents using BusyBox tar, where escape sequences hide malicious entries
4. Victim extracts the archive, unknowingly extracting hidden malicious files

The vulnerability mechanism involves embedding ANSI escape sequences such as cursor movement codes, line clearing sequences, or overwrite commands within filenames. When displayed on a terminal, these sequences execute their control functions rather than being displayed as literal characters, effectively hiding or obfuscating the malicious filename entries.

Detection Methods for CVE-2025-46394

Indicators of Compromise

• TAR archives containing filenames with embedded ANSI escape sequences (byte patterns starting with \\x1b[ or \033[)
• Archive listings that appear incomplete or show fewer files than expected
• Unexpected files appearing after TAR extraction that were not visible in listings
• Terminal display anomalies when listing archive contents

Detection Strategies

• Implement file integrity monitoring to detect unexpected files after archive extraction operations
• Use hex dump or binary inspection tools to examine TAR archive contents for hidden escape sequences
• Configure endpoint detection to alert on TAR extraction operations that result in more files than displayed during listing
• Deploy static analysis rules to scan incoming TAR archives for embedded terminal control characters in filename fields

Monitoring Recommendations

• Monitor systems running BusyBox for suspicious TAR extraction activities
• Implement logging for archive operations in critical environments
• Review extracted files against archive listings to detect discrepancies
• Consider using alternative archive inspection tools that sanitize terminal output

How to Mitigate CVE-2025-46394

Immediate Actions Required

• Upgrade BusyBox to a patched version when available
• Use alternative tar implementations (GNU tar) that properly sanitize terminal output for archive inspection
• Pipe tar listing output through sanitization utilities before display
• Implement archive scanning procedures before extraction in security-sensitive environments

Patch Information

As of the last update, users should monitor the BusyBox Official Website and BusyBox Downloads Page for updated releases addressing this vulnerability. The issue is tracked in BusyBox Bug Report #16018. Additional discussion is available in the Openwall OSS-Security Update 04/23 and Openwall OSS-Security Update 04/24 security mailing list posts.

Workarounds

• Use tar -tvf archive.tar | cat -v to display filenames with escape sequences rendered as visible caret notation
• Employ hexdump or xxd to inspect archive contents at the binary level before extraction
• Use GUI-based archive managers that do not interpret terminal escape sequences
• Extract archives in isolated environments and verify contents before moving to production systems
• Consider implementing archive scanning policies that reject archives containing control characters in filenames

# Workaround: Sanitize tar listing output to reveal hidden escape sequences
busybox tar -tvf archive.tar | cat -v

# Alternative: Use sed to strip ANSI escape sequences
busybox tar -tvf archive.tar | sed 's/\\x1b\[[0-9;]*m//g'

# Inspect archive for suspicious escape sequences
hexdump -C archive.tar | grep -E '1b 5b|\\033'