Executive brief
zip-local is a Node.js library for creating and extracting ZIP archives. Versions before 0.3.5 are vulnerable to a "Zip Slip" attack where a specially crafted archive can extract files outside the intended target directory, allowing an attacker to overwrite arbitrary files on the system and potentially achieve remote code execution.
Technical details
The zip-local library prior to 0.3.5 is vulnerable to Zip Slip (CWE-29, CWE-668), an archive extraction vulnerability where path traversal sequences (e.g., "../") in archive entry names are not properly validated. When extracting a malicious ZIP file, an attacker can craft archive entries with absolute or traversal paths that escape the intended extraction directory. This allows writing files to arbitrary locations on the filesystem with the privileges of the application using zip-local. The vulnerability was patched in version 0.3.5 by adding validation to ensure extracted entries remain within the target extraction directory (commit 6bb9b59). No authentication or user interaction is required to exploit this vulnerability when processing untrusted archives.
Affected products
- npm zip-local before 0.3.5
Timeline
- 2022-02-01: disclosed
- 2022-02-01: patched: Fixed in version 0.3.5