Arbitrary File Write

Protodump contains a path traversal vulnerability that allows to write files to arbitrary locations on the filesystem outside the intended output directory. This occurs due to insufficient validation of the go_package option extracted from protobuf descriptors embedded in analyzed binaries.

func (pd *ProtoDefinition) Filename() string {
    goPackage := pd.pb.GetOptions().GetGoPackage()
    index := strings.Index(goPackage, ";")
    if index == -1 {
        return pd.descriptor.Path()
    }
    // BUG: No sanitization of goPackage path
    return path.Join(goPackage[:index], …