Vulnerability	Vulnerable Version
M Directory Traversal penelope-shell-handler is a Post-exploitation shell handler for authorized security testing Affected versions of this package are vulnerable to Directory Traversal in the `download` process when extracting tar archives from a remote session without validating archive member paths. An attacker can write arbitrary files outside the intended directory and potentially achieve code execution by crafting a tar archive with path traversal entries and influencing the files written on the operator's machine. This is only exploitable if the operator uses the Main Menu `download` command to retrieve files from a malicious or compromised remote session capable of returning a crafted tar archive. How to fix Directory Traversal? Upgrade `penelope-shell-handler` to version 0.20.0 or higher.	[,0.20.0)

Directory Traversal

penelope-shell-handler is a Post-exploitation shell handler for authorized security testing

Affected versions of this package are vulnerable to Directory Traversal in the download process when extracting tar archives from a remote session without validating archive member paths. An attacker can write arbitrary files outside the intended directory and potentially achieve code execution by crafting a tar archive with path traversal entries and influencing the files written on the operator's machine. This is only exploitable if the operator uses the Main Menu download command to retrieve files from a malicious or compromised remote session capable of returning a crafted tar archive.

How to fix Directory Traversal?

Upgrade penelope-shell-handler to version 0.20.0 or higher.

[,0.20.0)

Go back to all versions of this package