Path Traversal in Zipline Through 4.4.0

Executive Summary

Zipline through 4.4.0 has a path traversal vulnerability where authenticated users can read arbitrary server files by manipulating the :id parameter in the GET /api/user/files/:id/raw endpoint. The application incorrectly treats the :id as a datasource key, allowing encoded traversal sequences to escape the Local datasource uploads directory and access files like /etc/shadow.

Useful 0 Not Useful 0

Detection Guidance

Check if your Zipline instance is running version 4.4.0 or earlier. Monitor logs for unusual GET requests to /api/user/files/:id/raw with encoded traversal sequences like ../ or ..%2f. Test with curl commands like curl -u username:password http://target/api/user/files/..%2f..%2f..%2fetc%2fshadow/raw to verify exposure.

Inspect network traffic for repeated failed authentication attempts or unusual file access patterns targeting sensitive paths like /etc/passwd or /etc/shadow.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with valid credentials to read sensitive system files such as /etc/passwd or /etc/shadow, potentially exposing passwords, configuration files, or application secrets. This could lead to further system compromise or data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Zipline to the latest version beyond 4.4.0 immediately. If upgrading is not possible, restrict access to the /api/user/files/:id/raw endpoint via firewall rules or disable it entirely.

Ensure the LocalDatasource implementation enforces strict path containment. Review and remove any unnecessary authenticated user permissions that could exploit this flaw.

Useful 0 Not Useful 0