Arbitrary File Write in extract-zip Library

Executive Summary

This vulnerability in extract-zip through 2.0.1 allows an attacker to write files outside the intended destination directory. It occurs because the tool only checks the parent directory of archive entries and not the final path component. An attacker can create a ZIP file with a symlink pointing outside the target directory followed by a regular file with the same name, causing the tool to overwrite files outside the intended location.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect ZIP files for symlinks targeting outside the extraction directory. Use tools like 'zipinfo' to list archive contents and check for suspicious symlinks. Example command: zipinfo -l malicious.zip. Also, monitor file writes outside expected directories during extraction.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to overwrite critical system files, modify configurations, or plant malicious files on your system. If you use extract-zip to process untrusted ZIP files, an attacker could gain control over your system or steal sensitive data by manipulating file paths.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements under GDPR and HIPAA. Organizations processing sensitive data with extract-zip may face compliance violations if attackers exploit this flaw to access or alter protected information.

Useful 0 Not Useful 0

Mitigation Strategies

Update extract-zip to version 2.0.2 or later, which fixes the path traversal issue. If using npm, run npm update extract-zip. Review ZIP files for symlinks targeting outside the extraction directory before processing.

Useful 0 Not Useful 0