Zip Bomb Denial of Service in GuardDog safe_extract() Pre

Compliance Impact

The provided resources do not contain information about how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusually large disk space consumption caused by extracting ZIP archives, especially those related to GuardDog package extractions. Since the issue involves zip bombs that decompress to gigabytes from small compressed files, you can look for processes extracting ZIP files that cause rapid disk usage growth. Specific commands are not provided in the resources, but general approaches include: 1) Monitoring disk usage with commands like `du -sh` on extraction directories, 2) Using system monitoring tools to detect processes with high disk I/O or unexpected resource consumption during GuardDog usage, and 3) Reviewing GuardDog logs if debug logging is enabled to trace extraction operations and detect failures or warnings related to zip bombs. To mitigate, ensure GuardDog is updated to version 2.7.1 or later, which includes protections against zip bombs. No explicit detection commands are given in the provided resources. [1, 2]

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in GuardDog versions prior to 2.7.1, where the safe_extract() function does not validate the size of files after decompressing ZIP archives such as wheels or eggs. This allows attackers to create zip bombs—malicious compressed files that expand to consume very large amounts of disk space from a small compressed size, potentially causing denial of service.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this vulnerability by distributing a malicious package that, when extracted by GuardDog, consumes gigabytes of disk space from just a few megabytes of compressed data. This can lead to denial of service by exhausting disk resources, potentially disrupting system operations or causing failures.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade GuardDog to version 2.7.1 or later, where the safe_extract() function properly validates decompressed file sizes to prevent zip bomb denial of service attacks.

Useful 0 Not Useful 0