Path Traversal in MantisZip via Preview Component

Executive Summary

This vulnerability is a path traversal flaw in MantisZip up to version 0.4.5. It occurs in the function Path.Combine within MainWindow.UI.cs, specifically in the Preview component. Attackers can exploit this by manipulating the file path to escape the intended temporary directory using sequences like '..', allowing them to write files to arbitrary writable locations on the system.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual file writes outside expected directories, especially in user-writable locations. Check for ZIP files with paths containing '..' sequences. Inspect MantisZip logs for errors related to file operations or path traversal attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to severe consequences such as arbitrary file overwrites, persistent backdoors, or DLL hijacking, which could result in remote code execution. An attacker only needs to trick a user into double-clicking a malicious ZIP entry to trigger the exploit.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, potentially violating data protection requirements under GDPR and HIPAA. Unauthorized file writes may expose sensitive data or allow persistence of malicious code, undermining compliance with confidentiality and integrity controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately stop using MantisZip versions up to 0.4.5. Apply input validation to ensure file paths remain within intended directories. Use Path.GetFileName to strip malicious path segments. Update to a patched version once available. Monitor for suspicious file writes or unauthorized changes.

Useful 0 Not Useful 0