Denial of Service in fflate via ZIP64 Handling

Executive Summary

fflate through 0.8.2 has a denial of service vulnerability in unzipSync() due to an infinite loop. A crafted ZIP file with a central directory entry declaring compressed_size=0xFFFFFFFF but missing the required ZIP64 extra field tag causes z64e() to loop indefinitely. This happens because out-of-bounds reads return undefined, which coerces to 0, keeping the loop condition true.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect any ZIP archives processed by fflate for central directory entries with compressed_size=0xFFFFFFFF but missing the ZIP64 extra field tag 0x0001. Use tools like 'zipdetails' or '7z l' to analyze ZIP files for malformed structures.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause system crashes or hangups by consuming excessive CPU resources when processing malicious ZIP files. It may lead to denial of service if exploited in applications handling untrusted input, potentially disrupting services or applications relying on fflate for decompression.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service via infinite loops during decompression of crafted ZIP archives. It does not directly impact data confidentiality or integrity but may lead to system unavailability. Compliance impact depends on whether the affected system processes untrusted data in regulated environments. GDPR may require breach notification if service disruption affects data subjects, while HIPAA could view prolonged downtime as a potential security incident affecting access to protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update fflate to the latest version beyond 0.8.2. If updating is not possible, avoid processing untrusted ZIP files with fflate or implement strict input validation to reject ZIP64 sentinel values without the required extra field.

Useful 0 Not Useful 0