CVE-2018-1002206: SharpCompress directory traversal in archive extraction

Executive brief

SharpCompress is a popular library used by developers to handle compressed files like ZIP and RAR archives. A security flaw in versions before 0.21.0 allows a malicious archive to write files to unintended locations on a computer when it is extracted. This could allow an attacker to overwrite critical system files or application data, potentially compromising the integrity of the system.

Technical details

SharpCompress prior to version 0.21.0 is vulnerable to a directory traversal attack, commonly known as 'Zip Slip'. The vulnerability exists because the library does not properly validate or neutralize file paths contained within an archive during the extraction process. An attacker can craft a malicious archive containing filenames with traversal sequences (e.g., '../../') to write files outside of the intended target directory. This local attack requires a user to extract a malicious archive using the vulnerable library. Successful exploitation can lead to arbitrary file overwrite on the host system. The issue is fixed in version 0.21.0.

Affected products

• SharpCompress SharpCompress < 0.21.0

Timeline

• 2018-07-25: advisory: NVD published CVE-2018-1002206
• 2019-09-11: disclosed: GitHub Advisory published

References

• https://api.github.com/users/geoffodonnell
• https://github.com/geoffodonnell
• https://api.github.com/users/geoffodonnell/gists%7B/gist_id%7D
• https://api.github.com/users/geoffodonnell/repos
• https://avatars.githubusercontent.com/u/89282445?v=4
• https://api.github.com/users/geoffodonnell/events%7B/privacy%7D