Path Traversal in Zipline File Rename Endpoint

Executive Summary

This is a path traversal vulnerability in Zipline 4.4.0 where authenticated users can overwrite existing files by exploiting unsanitized input in the rename endpoint. Attackers use directory traversal sequences like ../uploads/victim.txt which bypass database checks but normalize during filesystem operations, allowing fs.rename() to replace other files.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious file renames or overwrites in logs, particularly for the PATCH /api/user/files/:id endpoint. Monitor filesystem changes in upload directories using tools like auditd or fsnotify. Look for filenames containing '../' or similar traversal sequences in rename operations.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid credentials could overwrite critical files, leading to data corruption, defacement of the application, or replacement of trusted files with malicious content. This could disrupt services or enable further attacks if the overwritten files are system or application components.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data modification or destruction, violating integrity requirements in GDPR and HIPAA. If sensitive data is overwritten, it may result in non-compliance with data protection and integrity controls mandated by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the PATCH /api/user/files/:id endpoint if possible. Implement strict input validation for filenames, rejecting any containing path traversal sequences like '../'. Upgrade to a patched version if available. Restrict filesystem permissions to limit write access for the Zipline application.

Useful 0 Not Useful 0