Microsoft APM CLI File Overwrite Vulnerability Critical

A severe security flaw has been disclosed in the Microsoft APM command-line interface (apm-cli), exposing Windows users to arbitrary local file overwrites. Tracked under the advisory GHSA-mq5j-pw29-jcv3, this absolute-path tar member overwrite vulnerability affects apm-cli versions up to and including v0.12.4.

The vulnerability specifically impacts environments running on Windows with Python versions 3.10 and 3.11. With the release of patched version 0.13.0, security researchers and system administrators are urging immediate updates to prevent highly damaging exploitation vectors, including the silent modification of critical CI/CD pipeline automation files.

At the core of this vulnerability is a broken trust boundary within the archive extraction process of the APM tool. When a developer or automated system executes the apm install <bundle> command utilizing a local .tar.gz file, the system must first determine the format of the bundle.

If the archive is not immediately recognized as a standard plugin-format bundle, APM triggers a legacy-bundle probe to check if it matches an older --format apm structure.

Microsoft APM CLI Vulnerability

During this classification phase, the tool unpacks the tarball to inspect its contents. However, on Python versions earlier than 3.12, this probe utilizes the raw tar.extractall() function without properly sanitizing or rejecting archive members that contain Windows absolute paths (such as D:/apm/run-main-install/outside/legacy-probe-outside-main.txt).

Because the raw extraction executes before the system formally rejects the bundle for being an invalid legacy format, a malicious actor can craft a disguised tarball that weaponizes this verification step.

The moment the package manager attempts to read the file to classify it, the malicious payload is extracted to an arbitrary location on the host filesystem, completely bypassing the intended temporary extraction root sandbox.

Security researcher Moderatedanielmeppiel, who originally published the finding, highlighted that the vulnerability hinges on specific code execution paths in src/apm_cli/bundle/local_bundle.py. When analyzing the source code, a glaring inconsistency in validation becomes apparent.

The adjacent detect_local_bundle() function properly sanitizes inputs by explicitly rejecting absolute paths (PureWindowsPath(name).is_absolute()), Windows drive letters (PureWindowsPath(name).drive), and directory traversal payloads.

Unfortunately, the secondary fallback function, _looks_like_legacy_apm_bundle(), fails to inherit or reuse these rigorous pre-extraction validation checks.

It simply opens the tarball, blocks symlinks and hardlinks, and immediately calls the vulnerable tar.extractall(tmp) function. By the time the function searches for the apm.lock.yaml file to confirm the bundle type and ultimately throws an error rejecting the installation, the malicious arbitrary file write has already occurred.

The implications of this vulnerability extend far beyond simple file creation. It is a high-integrity overwrite primitive. A threat actor can exploit this oversight not only to drop new malicious executables onto a victim’s machine but also to overwrite pre-existing, critical system or repository files.

In a demonstrated proof-of-concept (PoC), researchers proved that this vulnerability could be weaponized to overwrite project workflow files. By crafting an archive that targets .github/workflows/ci.yml, an attacker can seamlessly replace secure automation scripts with malicious YAML configurations.

When the victim runs apm install on the crafted payload, the system extracts the malicious YAML over the legitimate CI file. Even though the APM tool immediately outputs an error stating, “Requires the plugin format. Repack with ‘apm pack’…”, the damage is already done.

The next time the developer pushes their repository to GitHub, the compromised workflow file will execute the attacker’s commands within the trusted continuous integration environment. This essentially pivots a local extraction flaw into a massive supply chain compromise vector.

Further investigation into the apm-cli architecture revealed that this exact absolute-path extraction weakness was mirrored in the apm unpack command. Located in src/apm_cli/bundle/unpacker.py, the unpacker successfully rejected standard path traversal sequences like ../ and root directory slashes /, but entirely missed Windows absolute tar member names.

While apm unpack is a deprecated command, its inclusion in the vulnerability report underscores a systemic lack of robust path validation across legacy package management functions.

A critical nuance of this vulnerability is its reliance on the underlying Python runtime.The vulnerability report explicitly scopes the threat to Windows installations running Python 3.10 or 3.11.

This runtime dependency exists because of fundamental security improvements introduced in the Python standard library in version 3.12. In Python 3.12, the tarfile module was overhauled to address exactly this class of historical “Zip Slip” and tar extraction vulnerabilities.

Python 3.12 introduced extraction filters (such as data_filter) that inherently block absolute paths and dangerous symlinks during extractall() calls. Because apm-cli runs on older Python 3.10 and 3.11 environments that lack these native safeguards, the application-level failure to sanitize inputs results in full exploitability.

Mitigation

The maintainers of Microsoft APM have addressed this critical oversight in version 0.13.0. The comprehensive patch involves several key architectural corrections designed to eliminate the root cause of the vulnerability.

Unified Validation Logic: The patch reuses the robust pre-extraction validation already implemented in the detect_local_bundle() function, applying it directly to _looks_like_legacy_apm_bundle().
Absolute Path Rejection: The system now forcefully rejects any archive members containing Windows absolute paths prior to initiating any extraction sequence, regardless of the underlying Python runtime capabilities.
Comprehensive Coverage: Equivalent Windows absolute-path validation has been applied to the deprecated unpacker function to seal off secondary attack surfaces.

Recommendations for Developers

Upgrade Immediately: All users and automated environments utilizing apm-cli must be updated to version 0.13.0 or later to ensure protection against this exploit.
Audit CI/CD Environments: Development teams should review their CI/CD runners and local environments to ensure no untrusted local bundles are automatically parsed or probed by vulnerable APM versions.
Runtime Upgrades: Where feasible, organizations should upgrade their underlying runtime environments to Python 3.12+ to benefit from native, standard-library-level protections against archive extraction boundary failures.