Executive brief
adm-zip is a popular JavaScript library used to create and extract compressed ZIP archives. A vulnerability known as 'Zip Slip' allows an attacker to create a malicious ZIP file that, when extracted, writes files to locations outside of the intended folder. This could allow an attacker to overwrite critical system files or configuration data, potentially leading to system instability or unauthorized code execution.
Technical details
The adm-zip library fails to properly validate file paths within a ZIP archive during the extraction process. By including 'dot-dot-slash' (../) sequences in the filenames within a specially crafted archive, an attacker can trigger a path traversal vulnerability (CWE-22). When the library's extraction functions (such as extractAllTo) concatenate the malicious entry name with the target directory, the resulting path resolves outside the intended destination. This allows for arbitrary file writes on the local filesystem. The issue is fixed in version 0.4.9 by ensuring the resolved absolute path of the extracted file starts with the absolute path of the target directory.
Affected products
- cthackers adm-zip < 0.4.9
Timeline
- 2018-04-22: patched: Pull request with fix submitted to cthackers/adm-zip
- 2018-07-25: advisory: NVD published CVE-2018-1002204
- 2018-07-27: disclosed: GitHub Advisory published