Path Traversal in VisiData via Malicious ZIP File

Executive Summary

This is a path traversal vulnerability in VisiData's unzip_http RemoteZipFile extract functionality. It allows a specially crafted .zip file to write arbitrary files to any location on the filesystem writable by the victim's user. The issue occurs because VisiData does not sanitize filenames from the zip archive before writing them to disk, enabling path traversal sequences like ../../ to escape the intended extraction directory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual file writes or unexpected network activity from VisiData processes. Check for suspicious .zip files downloaded from untrusted sources. Use commands like 'lsof' or 'netstat' to track file operations and network connections initiated by VisiData.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this by providing a malicious URL to a VisiData user. If the user opens the URL and triggers extraction, the attacker could write arbitrary files to any writable location on the system. This could lead to data corruption, unauthorized file creation, or potential execution of malicious code depending on the files written.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR or HIPAA if exploited to write sensitive files to unauthorized locations. Arbitrary file writes may expose or modify protected data, leading to unauthorized access or data breaches. However, the provided context does not explicitly detail compliance impacts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update VisiData to the latest version or commit that patches this issue. Avoid opening .zip files from untrusted sources. Disable the unzip_http RemoteZipFile functionality if not required. Monitor filesystem writes for unexpected activity.

Useful 0 Not Useful 0