Executive brief
decompress-zip is a Node.js library used to extract and process ZIP archives. The library fails to validate that extracted files stay within the intended extraction directory, allowing an attacker to craft a malicious ZIP file that overwrites arbitrary files on the system. This can lead to remote code execution if critical executable files or configuration files are overwritten.
Technical details
The vulnerability is a Zip Slip arbitrary file write flaw (CWE-22 path traversal). The root cause is insufficient validation of file paths extracted from ZIP archives; decompress-zip does not check that extracted file paths do not traverse outside the target extraction directory using sequences like "../". An attacker can craft a malicious ZIP archive containing entries with path traversal sequences (e.g., "../../../../tmp/evil.sh") that, when extracted by vulnerable versions of the library, write files to locations outside the intended directory. No authentication or special privileges are required—the attacker only needs to supply a malicious ZIP file to an application using decompress-zip. The vulnerability affects all versions before 0.2.2 and versions 0.3.0 through 0.3.1; patches are available in versions 0.2.2 and 0.3.2 or later.
Affected products
- decompress-zip decompress-zip <0.2.2, 0.3.0-0.3.1
Timeline
- 2020-09-02: disclosed
- 2020-09-02: patched: Patches available in versions 0.2.2 and 0.3.2