Path Traversal in Zipline Data Export Endpoint

Executive Summary

Zipline versions from 3.4.5 before 3.7.10 have a path traversal vulnerability in the user data export endpoint. This flaw allows authenticated attackers to bypass user ID checks and use directory traversal sequences in the name query parameter to read arbitrary files on the server host.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Zipline instance is running a version between 3.4.5 and 3.7.10. Use the command 'npm list zipline' or check the version in the application interface. If vulnerable, test the export endpoint with crafted requests to see if arbitrary files can be accessed.

Useful 0 Not Useful 0

Impact Analysis

Authenticated attackers could exploit this to access sensitive files on the server, potentially leading to unauthorized data disclosure, system compromise, or further attacks. The impact depends on the server's file permissions and the files accessible to the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information). Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Zipline to version 3.7.10 or later. If upgrading is not possible, restrict access to the export endpoint by implementing proper authentication and authorization checks. Review server file permissions to limit exposure.

Useful 0 Not Useful 0