Summary
A high-severity path traversal vulnerability in Bower decompress-zip can mishandle archive entry paths during ZIP extraction. When an attacker supplies a crafted archive and the application extracts it, files may be written outside the intended destination, potentially enabling file overwrite, application compromise, or remote code execution.
A high-severity path traversal vulnerability in Bower decompress-zip can mishandle archive entry paths during ZIP extraction. When an attacker supplies a crafted archive and the application extracts it, files may be written outside the intended destination, potentially enabling file overwrite, application compromise, or remote code execution.
Affected context
The vulnerability may occur in applications using Bower decompress-zip through version 0.3.3 to extract ZIP archives. Risk depends on whether attacker-controlled archives can reach the extraction function and whether the process has write access to directories outside the intended extraction root, including prefix-sibling paths.
The vulnerability may occur in applications using Bower decompress-zip through version 0.3.3 to extract ZIP archives. Risk depends on whether attacker-controlled archives can reach the extraction function and whether the process has write access to directories outside the intended extraction root, including prefix-sibling paths.
Exploit preconditions
- Attack surface: ZIP archive extraction through the decompress-zip library
- Required access: Ability to provide or influence an archive processed by the application
- Trigger point: Validation and extraction of archive entry paths
- Why exploitation is possible: Path checks may incorrectly treat prefix-sibling directories as being inside the intended extraction directory, allowing selected entries to escape the extraction root
- Attack surface: ZIP archive extraction through the decompress-zip library
- Required access: Ability to provide or influence an archive processed by the application
- Trigger point: Validation and extraction of archive entry paths
- Why exploitation is possible: Path checks may incorrectly treat prefix-sibling directories as being inside the intended extraction directory, allowing selected entries to escape the extraction root
Why this happens
The underlying bug is insufficient canonical path validation during archive extraction. A destination check that compares textual path prefixes without enforcing a proper directory boundary can classify a sibling path as belonging to the intended extraction directory.
This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), because archive-controlled filenames can influence filesystem destinations beyond the directory selected by the application.
The underlying bug is insufficient canonical path validation during archive extraction. A destination check that compares textual path prefixes without enforcing a proper directory boundary can classify a sibling path as belonging to the intended extraction directory.
This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), because archive-controlled filenames can influence filesystem destinations beyond the directory selected by the application.
Potential impact
- An attacker may overwrite files outside the intended extraction directory
- Application configuration or executable files could be modified
- The affected service may be disrupted or rendered unavailable
- Application compromise or arbitrary code execution could occur where overwritten files are later trusted or executed
- Writable sibling directories could be used for persistence or lateral impact
- An attacker may overwrite files outside the intended extraction directory
- Application configuration or executable files could be modified
- The affected service may be disrupted or rendered unavailable
- Application compromise or arbitrary code execution could occur where overwritten files are later trusted or executed
- Writable sibling directories could be used for persistence or lateral impact
General mitigation guidance
Mitigation generally focuses on treating archive entry names as untrusted filesystem paths and enforcing extraction boundaries using canonicalized paths.
Common defensive patterns include:
- Resolve each destination path and verify that it remains within the canonical extraction directory using a directory-aware boundary check
- Reject absolute paths, traversal components, and entries that resolve through prefix-sibling directories
- Prefer extraction APIs that provide built-in path traversal protection
- Extract into an isolated, dedicated directory with minimal filesystem permissions
- Apply least privilege to the process performing extraction and avoid writable application or executable paths
- Limit archive size, entry count, nesting, and file types where appropriate
- Treat extracted content as untrusted until separately validated
Mitigation generally focuses on treating archive entry names as untrusted filesystem paths and enforcing extraction boundaries using canonicalized paths.
Common defensive patterns include:
- Resolve each destination path and verify that it remains within the canonical extraction directory using a directory-aware boundary check
- Reject absolute paths, traversal components, and entries that resolve through prefix-sibling directories
- Prefer extraction APIs that provide built-in path traversal protection
- Extract into an isolated, dedicated directory with minimal filesystem permissions
- Apply least privilege to the process performing extraction and avoid writable application or executable paths
- Limit archive size, entry count, nesting, and file types where appropriate
- Treat extracted content as untrusted until separately validated
How teams detect issues like this
Organizations can identify related risks through:
- Static analysis rules for archive extraction APIs followed by direct path concatenation or weak prefix comparisons
- Code review checks for missing canonicalization and directory-boundary validation
- Tests using absolute paths, traversal components, and prefix-sibling destination names
- Runtime monitoring for extraction processes writing outside approved directories
- File integrity monitoring on configuration, executable, and deployment paths
- Policy enforcement that restricts archive extraction to isolated, least-privileged workspaces
Automated code review and dependency-analysis tools may help identify vulnerable extraction patterns and affected library usage.
Organizations can identify related risks through:
- Static analysis rules for archive extraction APIs followed by direct path concatenation or weak prefix comparisons
- Code review checks for missing canonicalization and directory-boundary validation
- Tests using absolute paths, traversal components, and prefix-sibling destination names
- Runtime monitoring for extraction processes writing outside approved directories
- File integrity monitoring on configuration, executable, and deployment paths
- Policy enforcement that restricts archive extraction to isolated, least-privileged workspaces
Automated code review and dependency-analysis tools may help identify vulnerable extraction patterns and affected library usage.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| moizxsec. | moizxsec.github.io/ |
