Path Traversal in Fossify File Manager

Executive Summary

This vulnerability is a path traversal issue in Fossify File Manager version 1.6.2 or earlier. It allows attackers to create malicious ZIP archives that bypass a security check during extraction. The flaw occurs because the software uses an unanchored startsWith check to validate file paths, which can be tricked by entries like ../<name>_x/file. This lets the archive write files outside the intended extraction folder, potentially overwriting existing files or creating new ones in unauthorized locations.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect ZIP archives extracted by Fossify File Manager for entries containing '../' or similar path traversal sequences. Check extracted files outside the intended directory. Review logs for unexpected file writes during decompression.

Useful 0 Not Useful 0

Impact Analysis

If you use Fossify File Manager to extract ZIP files, an attacker could craft a malicious archive that overwrites important system files or user data when you extract it. This could lead to data corruption, unauthorized file creation, or even execution of malicious code if the overwritten files are later used by other programs. The attack requires you to manually open and confirm the extraction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to or modification of sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A successful exploit could expose or alter such data, violating these regulations and potentially leading to legal penalties or loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Update Fossify File Manager to the latest version beyond 1.6.2. Avoid extracting untrusted ZIP archives. Implement strict path validation in decompression logic. Monitor for suspicious file writes in sibling directories.

Useful 0 Not Useful 0