Path Traversal in Bower decompress-zip

Executive Summary

This is a path traversal vulnerability in Bower decompress-zip through version 0.3.3. It occurs because the library improperly validates archive entry paths during ZIP extraction. A crafted ZIP file can trick the library into writing files outside the intended directory by using paths that share a prefix with the target directory, such as ../userdir-EVIL/x escaping /uploads/userdir.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses decompress-zip version 0.3.3 or earlier. Inspect ZIP extraction processes for unexpected file writes outside intended directories. Monitor for suspicious file creation in sibling paths sharing prefixes with extraction targets.

Useful 0 Not Useful 0

Impact Analysis

Exploitation may allow attackers to overwrite arbitrary files, modify application configurations, or execute malicious code on the system. Since the library silently writes files outside the intended directory without errors, it could lead to data corruption, denial of service, or full system compromise depending on the environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized file access or modification. For GDPR, it may lead to unauthorized data exposure or processing. For HIPAA, it could allow tampering with protected health information. Organizations using affected versions risk non-compliance due to insufficient file path validation.

Useful 0 Not Useful 0

Mitigation Strategies

Replace decompress-zip with a maintained alternative like yauzl. Validate entry paths using path.relative() before extraction. Extract files to isolated directories. Implement allow-list-based file movement. Avoid using versions ≤ 0.3.3.

Useful 0 Not Useful 0