Arbitrary code execution through loading a malicious project

[xiaofen9]

Describe the bug
A path traversal vulnerability exists in RestoreTask.java from package ghidra.app.plugin.core.archive. This vulnerability allows attackers to overwrite arbitrary files in the system. To achieve arbitrary code execution, one of the solutions is to overwrite some critical ghidra modules, e.g., decompile module (In this case we need to know the installation path of ghidra).

To Reproduce

1. Load the malicious project.
2. malicious code will be executed when the decompile module is called.

Expected behavior
Here is a demo of the attack behavior.
https://youtu.be/RGqQMUd9hZM

Environment (please complete the following information):

• OS: All systems
• Ghidra Version: until v9.0.4

Remark
The vulnerability was found by researchers from GTISC@Georgia Tech.

[erhan-]

Congratulations. That's a nice discovery!

[ryanmkurtz]

Thanks for finding this...we are investigating it.

[xiaofen9]

Thanks for finding this...we are investigating it.

Thanks for bringing us this awesome dissembler.
Technical details about the vul can be found here. http://blog.fxiao.me/ghidra/.

[dev747368]

@xiaofen9 - please reopen this issue if this didn't address the problem

[xiaofen9]

Issue fixed according to my exploit. Thanks. Best regards, Feng Xiao dev747368 <notifications@github.com> 于2019年7月23日周二 上午10:16写道：

…

@xiaofen9 <https://github.com/xiaofen9> - please reopen this issue if this didn't address the problem — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#789?email_source=notifications&email_token=AE7S43JY2K35C5MSGF4XSFTQA4HCNA5CNFSM4IDQWNNKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD2TIEDA#issuecomment-514228748>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AE7S43I6BJQ55XUCAHX4RU3QA4HCNANCNFSM4IDQWNNA> .