Summary
A path traversal and symlink-handling vulnerability in the Rust zip library can let an attacker escape the intended extraction directory through crafted symbolic-link chains. If an attacker can supply or influence an archive and knows or guesses the extraction destination, files may be created or overwritten using the extracting process's privileges.
A path traversal and symlink-handling vulnerability in the Rust zip library can let an attacker escape the intended extraction directory through crafted symbolic-link chains. If an attacker can supply or influence an archive and knows or guesses the extraction destination, files may be created or overwritten using the extracting process's privileges.
Affected context
The issue affects applications using the Rust zip library's archive extraction
functions, including ZipArchive::extract and
ZipArchive::extract_unwrapped_root_dir, when processing archives containing
symbolic links. Risk is greater when an attacker can provide an archive,
influence extraction inputs, or predict the destination path. Windows-specific
behavior may also be relevant when symbolic-link creation privileges are
available.
The issue affects applications using the Rust zip library's archive extraction
functions, including ZipArchive::extract and
ZipArchive::extract_unwrapped_root_dir, when processing archives containing
symbolic links. Risk is greater when an attacker can provide an archive,
influence extraction inputs, or predict the destination path. Windows-specific
behavior may also be relevant when symbolic-link creation privileges are
available.
Exploit preconditions
- Attack surface: Archive extraction functionality in an application using the Rust zip library
- Required access: Ability to provide or influence a ZIP archive, directly or through an upstream file-transfer or ingestion workflow
- Trigger point: Extraction of archive entries containing a crafted symbolic-link chain
- Environmental condition: The extraction destination must be known or reasonably guessable
- Why exploitation is possible: Validation uses lexical path comparisons and simplified path components without resolving every intermediate symbolic link, allowing a link in the chain to redirect writes outside the intended directory
- Windows condition: A drive or UNC prefix may contribute to an escape when the extracting process can create symbolic links, such as with administrator rights or Developer Mode
- Attack surface: Archive extraction functionality in an application using the Rust zip library
- Required access: Ability to provide or influence a ZIP archive, directly or through an upstream file-transfer or ingestion workflow
- Trigger point: Extraction of archive entries containing a crafted symbolic-link chain
- Environmental condition: The extraction destination must be known or reasonably guessable
- Why exploitation is possible: Validation uses lexical path comparisons and simplified path components without resolving every intermediate symbolic link, allowing a link in the chain to redirect writes outside the intended directory
- Windows condition: A drive or UNC prefix may contribute to an escape when the extracting process can create symbolic links, such as with administrator rights or Developer Mode
Why this happens
The underlying bug is an incomplete containment check during archive extraction.
The affected logic compares normalized path representations lexically, but does
not fully resolve intermediate symbolic links before deciding whether a target
remains inside the extraction directory. This permits a path that appears
confined to the destination to resolve elsewhere at write time. The behavior
maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with related CWE-59: Improper Link Resolution Before File Access
and CWE-61: UNIX Symbolic Link Following.
The underlying bug is an incomplete containment check during archive extraction.
The affected logic compares normalized path representations lexically, but does
not fully resolve intermediate symbolic links before deciding whether a target
remains inside the extraction directory. This permits a path that appears
confined to the destination to resolve elsewhere at write time. The behavior
maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with related CWE-59: Improper Link Resolution Before File Access
and CWE-61: UNIX Symbolic Link Following.
Potential impact
- An attacker may create files outside the intended extraction directory.
- Existing files may be overwritten with the extracting process's privileges.
- Sensitive application, user, or system data could be modified.
- The extracting process could be used to alter configuration, scripts, or other operational files.
- A successful attack could contribute to code execution or broader host compromise, depending on writable targets and process privileges.
- An attacker may create files outside the intended extraction directory.
- Existing files may be overwritten with the extracting process's privileges.
- Sensitive application, user, or system data could be modified.
- The extracting process could be used to alter configuration, scripts, or other operational files.
- A successful attack could contribute to code execution or broader host compromise, depending on writable targets and process privileges.
General mitigation guidance
Mitigation generally focuses on resolving and validating the complete filesystem
path before every write, rather than relying only on lexical normalization.
Common defensive patterns include:
- Extracting into a dedicated directory with narrowly scoped permissions.
- Rejecting symbolic links, hard links, absolute paths, drive-qualified paths, and UNC paths when they are not required.
- Resolving each intermediate component and confirming that the final target remains within the approved extraction root.
- Using filesystem APIs and containment checks designed to resist link races where available.
- Applying least privilege to the extracting process and limiting its ability to modify sensitive locations.
- Treating archives as untrusted input and applying size, entry, and path policies before extraction.
- Using a maintained library release that contains the relevant security correction, subject to application compatibility testing.
Mitigation generally focuses on resolving and validating the complete filesystem
path before every write, rather than relying only on lexical normalization.
Common defensive patterns include:
- Extracting into a dedicated directory with narrowly scoped permissions.
- Rejecting symbolic links, hard links, absolute paths, drive-qualified paths, and UNC paths when they are not required.
- Resolving each intermediate component and confirming that the final target remains within the approved extraction root.
- Using filesystem APIs and containment checks designed to resist link races where available.
- Applying least privilege to the extracting process and limiting its ability to modify sensitive locations.
- Treating archives as untrusted input and applying size, entry, and path policies before extraction.
- Using a maintained library release that contains the relevant security correction, subject to application compatibility testing.
How teams detect issues like this
Detection can combine source review, automated analysis, and runtime controls.
Useful approaches include:
- Static analysis rules for archive extraction APIs that do not resolve symbolic links before file access.
- Code review checks for lexical-only prefix comparisons, path canonicalization gaps, and writes performed after untrusted link creation.
- Tests using nested symbolic links, absolute paths, drive-qualified paths, and UNC-style paths where the platform permits them.
- Policy enforcement that rejects links and out-of-root paths in uploaded archives.
- Runtime monitoring for extraction processes creating or modifying files outside designated staging directories.
- Dependency and software composition analysis to identify affected library usage and track security-relevant updates.
Detection can combine source review, automated analysis, and runtime controls.
Useful approaches include:
- Static analysis rules for archive extraction APIs that do not resolve symbolic links before file access.
- Code review checks for lexical-only prefix comparisons, path canonicalization gaps, and writes performed after untrusted link creation.
- Tests using nested symbolic links, absolute paths, drive-qualified paths, and UNC-style paths where the platform permits them.
- Policy enforcement that rejects links and out-of-root paths in uploaded archives.
- Runtime monitoring for extraction processes creating or modifying files outside designated staging directories.
- Dependency and software composition analysis to identify affected library usage and track security-relevant updates.
