Path Traversal in Zipline LocalDatasource

Executive Summary

Zipline before version 4.6.1 has a path traversal vulnerability in the LocalDatasource component. This flaw allows users with SUPERADMIN privileges to read or delete files outside the designated upload directory by importing records with specially crafted traversal filenames. Attackers can exploit this by using byte-range requests to trigger an unchecked range-read path or by setting expired deletion times to delete files accessible to the Zipline process.

Useful 0 Not Useful 0

Impact Analysis

If you are a SUPERADMIN user of Zipline before 4.6.1, an attacker could exploit this to read sensitive files outside the upload directory or delete critical files accessible to the Zipline process. This could lead to unauthorized data exposure, system instability, or denial of service if important files are deleted.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using affected versions of Zipline may face compliance violations, legal penalties, or reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Zipline to version 4.6.1 or later to address the path traversal vulnerability in LocalDatasource. Restrict SUPERADMIN privileges to trusted users only and review file access permissions for the Zipline process.

Useful 0 Not Useful 0