Executive brief
Calipso is a Node.js-based content management system. A zip slip vulnerability in its module installation functionality allows attackers to extract archive files outside their intended directory and overwrite arbitrary files on the system. An attacker with the ability to supply a malicious module could gain file write access across the entire file system.
Technical details
This vulnerability is a classic zip slip (path traversal) flaw (CWE-29, CWE-668) in Calipso's archive extraction logic during module installation. The module installer does not properly validate or sanitize file paths extracted from zip archives, allowing entries with path traversal sequences (e.g., "../../../etc/passwd") to write files outside the intended extraction directory. No authentication is required; an attacker who can trigger module installation with a crafted archive can write to arbitrary locations on the file system. The vulnerability affects all versions of Calipso through 0.3.54. Patches or updates may be unavailable as the project was archived.
Affected products
- Calipso Calipso 0.3.54 and all earlier versions
Timeline
- 2021-06-08: disclosed
- 2021-06-08: advisory: GHSA-jxcc-g75x-qgw9 published