alibaba__one-java-agent_CVE-2022-25842_0-0-1

one-java-agent 目标 1. 提供插件化支持，统一管理众多的Java Agent 2. 插件支持install/unstall，需要插件方实现接口 3. 支持传统的java agent，即已经开发好的java agent 插件系统 插件如果希望感知生命周期，可以实现 PluginActivator接口： root@kitploit: public interface PluginActivator // 让插件本身判断是否要启动 boolean enabledPluginContext context; public void initPluginContext contex...

CVE-2022-25842

CVE-2022-25842 affects all versions of com.alibaba.oneagent:one-java-agent-plugin. It is vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip): a crafted archive with directory traversal filenames (e.g., ../../evil.exe) can cause sensitive files to be overwritten, enabling remote c...

CVE-2022-25842 Arbitrary File Write via Archive Extraction (Zip Slip)

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip using a specially crafted archive that holds directory traversal filenames e.g. ../../evil.exe. The attacker can overwrite executable files and either invoke...

CVE-2022-25842

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip using a specially crafted archive that holds directory traversal filenames e.g. ../../evil.exe. The attacker can overwrite executable files and either invoke...