Zipline Path Traversal Leading to Arbitrary File Deletion

Executive Summary

Zipline through 4.4.0 has a path traversal vulnerability allowing authenticated attackers to delete arbitrary server files. Attackers exploit this by injecting traversal sequences via the x-zipline-file-extension header, uploading a file with a poisoned stored name and short expiry. The LocalDatasource deletion mechanism then removes chosen files, causing denial of service or data loss.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual file deletion activity or unauthorized file access patterns in server logs. Monitor for requests containing the x-zipline-file-extension header with path traversal sequences like ../. Look for files with poisoned names or short expiry times in upload directories.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial of service by deleting critical server files or data loss by removing important data. Attackers with authentication can target specific files, potentially disrupting services or compromising system integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Zipline to a patched version beyond 4.4.0 immediately. Disable or restrict access to file upload features for untrusted users. Review and remove any suspicious file uploads or deletions. Implement strict path validation for file names and headers.

Useful 0 Not Useful 0