CVE-2025-32953: Security Vulnerability in z80pack Emulator Leading to System Compromise

Overview

In the ever-evolving world of cybersecurity, vulnerabilities can be found in the most unexpected places. One such vulnerability, CVE-2025-32953, exists in the z80pack emulator, a mature software package used to emulate multiple platforms running the 8080 and Z80 CPUs. This vulnerability can lead to a potential system compromise or data leakage, posing a significant threat to systems utilizing this emulator. Not only could this impact the integrity of these systems, but it could also compromise any sensitive data stored therein.

Vulnerability Summary

CVE ID: CVE-2025-32953
Severity: High (8.7 CVSS score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System Compromise or Data Leakage

Affected Products

Product | Affected Versions

z80pack | 1.38 and prior

How the Exploit Works

The vulnerability lies in the `makefile-ubuntu.yml` workflow file of z80pack. This file uses `actions/upload-artifact@v4` to upload the `z80pack-ubuntu` artifact, which is a zip of the current directory. This directory includes the automatically generated `.git/config` file that contains the run’s GITHUB_TOKEN. The vulnerability comes into play because this artifact can be downloaded before the end of the workflow, creating a small window where an attacker can extract the token from the artifact.
With this token, an attacker can use the GitHub API to push malicious code or rewrite release commits in your repository. This could lead to a system compromise or potential data leakage.

Conceptual Example Code

The exploit could, conceptually, occur as follows:

# Downloading the z80pack-ubuntu artifact
wget https://github.com/z80pack/z80pack/actions/artifacts/123456/download
# Extracting the .git/config file containing the GITHUB_TOKEN
unzip z80pack-ubuntu.zip .git/config
# Using the extracted GITHUB_TOKEN to push malicious code
git clone https://github.com/z80pack/z80pack.git
cd z80pack
echo "malicious code" > exploit.js
git add exploit.js
git commit -m "Add new feature"
git push origin master

Please note that this is a simplified illustration of how the vulnerability might be exploited and does not represent an actual exploit.

Mitigation

To mitigate this vulnerability, users should promptly apply the vendor patch as provided in commit bd95916. Alternatively, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation against potential exploits.