Adm-Zip Decompression Bomb Bypass via getDataAsync

Executive Summary

This vulnerability in adm-zip 0.6.0 allows attackers to bypass decompression bomb protection by exploiting the asynchronous getDataAsync() method. The issue occurs because getDataAsync() does not enforce the maxOutputLength guard that the synchronous getData() method does. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses adm-zip version 0.6.0 or below by running: npm list adm-zip. If the version is vulnerable, update to 0.6.1 or later. Monitor for unusual memory consumption during ZIP file processing, especially with asynchronous methods.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory exhaustion in applications using adm-zip 0.6.0 or earlier when processing ZIP files asynchronously. Attackers could send specially crafted ZIP files to cause denial-of-service conditions by consuming excessive system memory.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to uncontrolled resource consumption, potentially causing denial-of-service conditions in applications processing ZIP files. For GDPR, this may violate Article 32 (security of processing) if it results in service disruptions. For HIPAA, it could impact availability requirements under the Security Rule if systems become unresponsive due to memory exhaustion.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update adm-zip to version 0.6.1 or higher using: npm update adm-zip. If updating is not possible, avoid using getDataAsync() and switch to synchronous methods like getData() which enforce size guards. Validate ZIP file sizes before processing.

Useful 0 Not Useful 0