x-pack/osquerybeat: prevent path traversal in .pkg CPIO extraction by marc-gr · Pull Request #51446 · elastic/beats

marc-gr · 2026-06-23T10:22:36Z

Proposed commit message

The macOS .pkg installer for osquery is extracted by expandPayload() in x-pack/osquerybeat/internal/pkgutil/expand.go, which reads CPIO entries and joins each entry's FilePath directly onto the destination directory. The entry name comes unsanitized from the archive, so a crafted .pkg containing ../ components could write files outside the destination directory (CWE-22). This path is only reachable on macOS, since .pkg/CPIO is the macOS osquery distribution format (Linux uses tar.gz, Windows uses msi/zip), and the sibling tar and zip extractors already validate entry paths — this brought CPIO extraction in line with them.

WHAT: Reject any entry whose name is not local using filepath.IsLocal before joining it with the destination directory, returning an error for traversal attempts.

WHY: Prevents arbitrary file write outside the intended directory from a malicious archive. filepath.IsLocal is the purpose-built stdlib check; it also rejects absolute paths and (on Windows) reserved names, making it stricter than a manual prefix comparison while keeping the intent self-documenting.

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

None. Well-formed osquery .pkg artifacts continue to extract unchanged; only entries whose paths escape the destination directory are now rejected.

How to test this PR locally

cd x-pack/osquerybeat
go test ./internal/pkgutil/...

The new tests in internal/pkgutil/expand_test.go cover normal extraction plus several path-traversal attempts (../escape.txt, ../../escape-dir, a/../../escape.txt), asserting extraction fails and nothing is written outside the destination directory.

Related issues

Relates elastic/security#11747

Use cases

Extraction of osquery's macOS .pkg distribution by osquerybeat during install/update.

The macOS .pkg installer for osquery is extracted by expandPayload() in pkgutil/expand.go, which reads CPIO entries and joins each entry's FilePath directly onto the destination directory. The entry name comes unsanitized from the archive, so a crafted .pkg containing "../" components could write files outside the destination directory (CWE-22). This was inconsistent with the sibling tar and zip extractors, which already validate entry paths. Reject any entry whose name is not local using filepath.IsLocal before joining it with the destination directory. IsLocal also rejects absolute paths and (on Windows) reserved names, making it stricter than a manual prefix check while keeping the intent obvious. Add unit tests covering normal extraction and several path-traversal attempts to lock in the behavior. Assisted-By: Cursor

github-actions · 2026-06-23T10:22:47Z

🤖 GitHub comments

Just comment with:

run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
/test : Run the Buildkite pipeline.

mergify · 2026-06-23T10:23:39Z

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @marc-gr? 🙏.
For such, you'll need to label your PR with:

The upcoming major version of the Elastic Stack
The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
backport-active-all is the label that automatically backports to all active branches.
backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

coderabbitai · 2026-06-23T10:26:24Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: bae8bc05-cdb0-4a54-a487-447757c0d296

📥 Commits

Reviewing files that changed from the base of the PR and between a168024 and f3f2d3a.

📒 Files selected for processing (3)

changelog/fragments/1782484560-osquerybeat-pkg-path-traversal.yaml
x-pack/osquerybeat/internal/pkgutil/expand.go
x-pack/osquerybeat/internal/pkgutil/expand_test.go

📝 Walkthrough

Walkthrough

expandPayload in x-pack/osquerybeat/internal/pkgutil/expand.go now calls filepath.IsLocal on each CPIO entry's FilePath before extraction; non-local paths return a formatted error. The full destination path is precomputed once and passed directly to writeFile, whose signature changes from (dstDir string, entry *cpio.Entry) to (fp string, entry *cpio.Entry). A new test file adds helpers to construct gzip-wrapped odc-cpio payloads and two test cases: one for normal extraction, one asserting traversal paths are rejected and nothing escapes the destination. A security changelog fragment records the CWE-22 fix scoped to osquerybeat.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

🛠️ Update Documentation

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

infra-vault-gh-plugin-prod · 2026-06-23T10:36:03Z

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

Switch the cpio header helper to fmt.Fprintf(&buf, ...) to satisfy staticcheck QF1012, and add an absolute-path (/escape.txt) traversal case to round out the coverage. Assisted-By: Cursor

…h-traversal

mergify · 2026-07-16T23:06:16Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

github-actions · 2026-07-21T10:04:34Z

@Mergifyio backport 9.5 9.4 9.3 8.19

mergify · 2026-07-21T10:04:42Z

backport 9.5 9.4 9.3 8.19

✅ Backports have been created

Details

#52127 [9.5](backport #51446) x-pack/osquerybeat: prevent path traversal in .pkg CPIO extraction has been created for branch 9.5
#52128 [9.4](backport #51446) x-pack/osquerybeat: prevent path traversal in .pkg CPIO extraction has been created for branch 9.4
#52129 [9.3](backport #51446) x-pack/osquerybeat: prevent path traversal in .pkg CPIO extraction has been created for branch 9.3
#52130 [8.19](backport #51446) x-pack/osquerybeat: prevent path traversal in .pkg CPIO extraction has been created for branch 8.19

…51446) (#52130) * x-pack/osquerybeat: prevent path traversal in .pkg CPIO extraction The macOS .pkg installer for osquery is extracted by expandPayload() in pkgutil/expand.go, which reads CPIO entries and joins each entry's FilePath directly onto the destination directory. The entry name comes unsanitized from the archive, so a crafted .pkg containing "../" components could write files outside the destination directory (CWE-22). This was inconsistent with the sibling tar and zip extractors, which already validate entry paths. Reject any entry whose name is not local using filepath.IsLocal before joining it with the destination directory. IsLocal also rejects absolute paths and (on Windows) reserved names, making it stricter than a manual prefix check while keeping the intent obvious. Add unit tests covering normal extraction and several path-traversal attempts to lock in the behavior. Assisted-By: Cursor * osquerybeat: address review feedback on pkg traversal test Switch the cpio header helper to fmt.Fprintf(&buf, ...) to satisfy staticcheck QF1012, and add an absolute-path (/escape.txt) traversal case to round out the coverage. Assisted-By: Cursor (cherry picked from commit 5041330) Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

…51446) (#52129) * x-pack/osquerybeat: prevent path traversal in .pkg CPIO extraction The macOS .pkg installer for osquery is extracted by expandPayload() in pkgutil/expand.go, which reads CPIO entries and joins each entry's FilePath directly onto the destination directory. The entry name comes unsanitized from the archive, so a crafted .pkg containing "../" components could write files outside the destination directory (CWE-22). This was inconsistent with the sibling tar and zip extractors, which already validate entry paths. Reject any entry whose name is not local using filepath.IsLocal before joining it with the destination directory. IsLocal also rejects absolute paths and (on Windows) reserved names, making it stricter than a manual prefix check while keeping the intent obvious. Add unit tests covering normal extraction and several path-traversal attempts to lock in the behavior. Assisted-By: Cursor * osquerybeat: address review feedback on pkg traversal test Switch the cpio header helper to fmt.Fprintf(&buf, ...) to satisfy staticcheck QF1012, and add an absolute-path (/escape.txt) traversal case to round out the coverage. Assisted-By: Cursor (cherry picked from commit 5041330) Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

…51446) (#52127) * x-pack/osquerybeat: prevent path traversal in .pkg CPIO extraction The macOS .pkg installer for osquery is extracted by expandPayload() in pkgutil/expand.go, which reads CPIO entries and joins each entry's FilePath directly onto the destination directory. The entry name comes unsanitized from the archive, so a crafted .pkg containing "../" components could write files outside the destination directory (CWE-22). This was inconsistent with the sibling tar and zip extractors, which already validate entry paths. Reject any entry whose name is not local using filepath.IsLocal before joining it with the destination directory. IsLocal also rejects absolute paths and (on Windows) reserved names, making it stricter than a manual prefix check while keeping the intent obvious. Add unit tests covering normal extraction and several path-traversal attempts to lock in the behavior. Assisted-By: Cursor * osquerybeat: address review feedback on pkg traversal test Switch the cpio header helper to fmt.Fprintf(&buf, ...) to satisfy staticcheck QF1012, and add an absolute-path (/escape.txt) traversal case to round out the coverage. Assisted-By: Cursor (cherry picked from commit 5041330) Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

…51446) (#52128) * x-pack/osquerybeat: prevent path traversal in .pkg CPIO extraction The macOS .pkg installer for osquery is extracted by expandPayload() in pkgutil/expand.go, which reads CPIO entries and joins each entry's FilePath directly onto the destination directory. The entry name comes unsanitized from the archive, so a crafted .pkg containing "../" components could write files outside the destination directory (CWE-22). This was inconsistent with the sibling tar and zip extractors, which already validate entry paths. Reject any entry whose name is not local using filepath.IsLocal before joining it with the destination directory. IsLocal also rejects absolute paths and (on Windows) reserved names, making it stricter than a manual prefix check while keeping the intent obvious. Add unit tests covering normal extraction and several path-traversal attempts to lock in the behavior. Assisted-By: Cursor * osquerybeat: address review feedback on pkg traversal test Switch the cpio header helper to fmt.Fprintf(&buf, ...) to satisfy staticcheck QF1012, and add an absolute-path (/escape.txt) traversal case to round out the coverage. Assisted-By: Cursor (cherry picked from commit 5041330) Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

marc-gr requested a review from a team as a code owner June 23, 2026 10:22

botelastic Bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jun 23, 2026

mergify Bot assigned marc-gr Jun 23, 2026

marc-gr added macOS Enable builds in the CI for darwin testing Osquerybeat bugfix Team:Security-Windows Platform Windows Platform Team in Security Solution labels Jun 23, 2026

botelastic Bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jun 23, 2026

marc-gr added the backport-active-all Automated backport with mergify to all the active branches label Jun 23, 2026

andrewkroh reviewed Jun 25, 2026

View reviewed changes

Comment thread x-pack/osquerybeat/internal/pkgutil/expand_test.go Outdated

Comment thread x-pack/osquerybeat/internal/pkgutil/expand_test.go

marc-gr added 2 commits July 6, 2026 09:42

osquerybeat: address review feedback on pkg traversal test

f1cda0c

Switch the cpio header helper to fmt.Fprintf(&buf, ...) to satisfy staticcheck QF1012, and add an absolute-path (/escape.txt) traversal case to round out the coverage. Assisted-By: Cursor

Merge remote-tracking branch 'upstream/main' into osquerybeat-pkg-pat…

03cda8e

…h-traversal

marc-gr requested a review from andrewkroh July 6, 2026 08:10

marc-gr added 2 commits July 14, 2026 12:15

Merge branch 'main' into osquerybeat-pkg-path-traversal

d51f806

Merge branch 'main' into osquerybeat-pkg-path-traversal

d1159a4

andrewkroh approved these changes Jul 16, 2026

View reviewed changes

marc-gr merged commit 5041330 into elastic:main Jul 21, 2026
29 checks passed

marc-gr deleted the osquerybeat-pkg-path-traversal branch July 21, 2026 10:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

x-pack/osquerybeat: prevent path traversal in .pkg CPIO extraction - #51446

x-pack/osquerybeat: prevent path traversal in .pkg CPIO extraction#51446
marc-gr merged 5 commits into
elastic:mainfrom
marc-gr:osquerybeat-pkg-path-traversal

marc-gr commented Jun 23, 2026

Uh oh!

github-actions Bot commented Jun 23, 2026

Uh oh!

mergify Bot commented Jun 23, 2026

Uh oh!

coderabbitai Bot commented Jun 23, 2026

Walkthrough

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jun 23, 2026

Uh oh!

Uh oh!

Uh oh!

mergify Bot commented Jul 16, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

mergify Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

marc-gr commented Jun 23, 2026

Proposed commit message

Checklist

Disruptive User Impact

How to test this PR locally

Related issues

Use cases

Uh oh!

github-actions Bot commented Jun 23, 2026

🤖 GitHub comments

Uh oh!

mergify Bot commented Jun 23, 2026

Uh oh!

coderabbitai Bot commented Jun 23, 2026

Walkthrough

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jun 23, 2026

Uh oh!

Uh oh!

Uh oh!

mergify Bot commented Jul 16, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

mergify Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Backports have been created

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mergify Bot commented Jul 21, 2026 •

edited

Loading