Summary
A directory traversal flaw in zip-lib allows crafted archive entries to escape the intended extraction directory by abusing a cached path validation mechanism.
When attackers control ZIP contents and symlink layout, they may bypass isOutsideTargetFolder checks and cause files to be written outside the target folder, potentially overwriting sensitive paths.
A directory traversal flaw in zip-lib allows crafted archive entries to escape the intended extraction directory by abusing a cached path validation mechanism.
When attackers control ZIP contents and symlink layout, they may bypass isOutsideTargetFolder checks and cause files to be written outside the target folder, potentially overwriting sensitive paths.
Affected context
This vulnerability appears in applications that use vulnerable versions of zip-lib (before 1.1.0) to extract untrusted or user-supplied ZIP archives.
It is most relevant when:
- The application relies on zip-lib's isOutsideTargetFolder to prevent directory traversal
- ZIP contents can be influenced by an attacker (file uploads, plugin packages, backups, or import/export features)
- Extraction is performed into directories that are on the same filesystem as sensitive application or system files
The issue is triggered during extraction when symlinks and nested paths are present, interacting with the caching-based path validation.
This vulnerability appears in applications that use vulnerable versions of zip-lib (before 1.1.0) to extract untrusted or user-supplied ZIP archives.
It is most relevant when:
- The application relies on zip-lib's isOutsideTargetFolder to prevent directory traversal
- ZIP contents can be influenced by an attacker (file uploads, plugin packages, backups, or import/export features)
- Extraction is performed into directories that are on the same filesystem as sensitive application or system files
The issue is triggered during extraction when symlinks and nested paths are present, interacting with the caching-based path validation.
Exploit preconditions
- Attack surface: ZIP archive extraction endpoints, file upload handlers, automated import jobs, or any service that unpacks attacker-controlled archives using zip-lib.
- Required access: Ability to provide or influence the ZIP file being extracted (e.g., authenticated user upload, external integration, or supply-chain package).
- Trigger point: The extraction process, especially when an archive includes symbolic links or crafted paths that are resolved after the initial path validation.
- Why exploitation is possible: isOutsideTargetFolder performs path checks once and caches the result at the time the initial directory symlink is created, not re-validating subsequent path resolutions. This allows an attacker to design archive structures where a previously "safe" cached path later resolves outside the target directory via symlink manipulation or traversal sequences.
- Attack surface: ZIP archive extraction endpoints, file upload handlers, automated import jobs, or any service that unpacks attacker-controlled archives using zip-lib.
- Required access: Ability to provide or influence the ZIP file being extracted (e.g., authenticated user upload, external integration, or supply-chain package).
- Trigger point: The extraction process, especially when an archive includes symbolic links or crafted paths that are resolved after the initial path validation.
- Why exploitation is possible: isOutsideTargetFolder performs path checks once and caches the result at the time the initial directory symlink is created, not re-validating subsequent path resolutions. This allows an attacker to design archive structures where a previously "safe" cached path later resolves outside the target directory via symlink manipulation or traversal sequences.
Why this happens
The underlying bug is an incomplete path canonicalization and validation strategy that relies on cached decisions.
Instead of validating each file's fully resolved, final extraction path against the intended target directory, zip-lib:
- Performs an isOutsideTargetFolder check when the initial directory (often involving a symlink) is processed
- Caches that decision and reuses it for later extractions under the assumption that the path's safety does not change
This pattern falls under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where attacker-controlled paths (including use of symlinks and ../ components) are not consistently normalized and checked at the time files are actually written to the filesystem.
The underlying bug is an incomplete path canonicalization and validation strategy that relies on cached decisions.
Instead of validating each file's fully resolved, final extraction path against the intended target directory, zip-lib:
- Performs an isOutsideTargetFolder check when the initial directory (often involving a symlink) is processed
- Caches that decision and reuses it for later extractions under the assumption that the path's safety does not change
This pattern falls under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where attacker-controlled paths (including use of symlinks and ../ components) are not consistently normalized and checked at the time files are actually written to the filesystem.
Potential impact
- Overwriting files outside the extraction directory that the application user or service account can access
- Planting or modifying configuration files that may alter application behavior
- Dropping web-accessible files (e.g., web shells) in server document roots, potentially leading to remote code execution in some environments
- Corrupting application data, logs, or other files relied on for integrity and auditing
- Escalating impact when combined with other misconfigurations (e.g., writable service scripts, cron jobs, or startup files)
- Overwriting files outside the extraction directory that the application user or service account can access
- Planting or modifying configuration files that may alter application behavior
- Dropping web-accessible files (e.g., web shells) in server document roots, potentially leading to remote code execution in some environments
- Corrupting application data, logs, or other files relied on for integrity and auditing
- Escalating impact when combined with other misconfigurations (e.g., writable service scripts, cron jobs, or startup files)
General mitigation guidance
Effective mitigation focuses on robust path validation and reducing trust in archive contents:
- Ensure that every extracted entry's final, canonical path is computed (resolving symlinks and
..segments) and checked against the intended base directory just before writing the file. - Avoid relying on cached "safe" directory checks; re-validate per entry to account for symlinks and later path changes.
- Limit the extraction target to dedicated, isolated directories that do not contain executable code or critical configuration where possible.
- Run archive extraction under a minimally privileged account with write access only to the intended extraction area.
- Consider ignoring or explicitly handling symlinks in archives (e.g., refusing them, or converting them to plain files if appropriate for the application model).
Effective mitigation focuses on robust path validation and reducing trust in archive contents:
- Ensure that every extracted entry's final, canonical path is computed (resolving symlinks and
..segments) and checked against the intended base directory just before writing the file. - Avoid relying on cached "safe" directory checks; re-validate per entry to account for symlinks and later path changes.
- Limit the extraction target to dedicated, isolated directories that do not contain executable code or critical configuration where possible.
- Run archive extraction under a minimally privileged account with write access only to the intended extraction area.
- Consider ignoring or explicitly handling symlinks in archives (e.g., refusing them, or converting them to plain files if appropriate for the application model).
How teams detect issues like this
Detection can leverage both code-centric and behavior-centric approaches:
- Static analysis and code review:
- Look for uses of zip-lib's extraction APIs that rely solely on built-in directory traversal checks without additional canonical path validation.
- Flag patterns that compute safety decisions once and then reuse cached results for multiple extracted entries.
- Review logic that permits symlinks or complex relative paths in archives without post-resolution checks.
- Runtime and operational monitoring:
- Monitor extraction processes for file writes outside expected directories, especially during ZIP imports from untrusted sources.
- Use filesystem auditing to detect unexpected modifications to configuration, executable, or web-root files during archive extraction operations.
- Policy enforcement and tooling:
- Include secure archive-handling policies in internal coding standards.
- Use automated code scanning tools or custom linters to detect path traversal anti-patterns and missing canonicalization steps.
Detection can leverage both code-centric and behavior-centric approaches:
- Static analysis and code review:
- Look for uses of zip-lib's extraction APIs that rely solely on built-in directory traversal checks without additional canonical path validation.
- Flag patterns that compute safety decisions once and then reuse cached results for multiple extracted entries.
- Review logic that permits symlinks or complex relative paths in archives without post-resolution checks.
- Runtime and operational monitoring:
- Monitor extraction processes for file writes outside expected directories, especially during ZIP imports from untrusted sources.
- Use filesystem auditing to detect unexpected modifications to configuration, executable, or web-root files during archive extraction operations.
- Policy enforcement and tooling:
- Include secure archive-handling policies in internal coding standards.
- Use automated code scanning tools or custom linters to detect path traversal anti-patterns and missing canonicalization steps.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| github. | github.com/ |
| security. | security.snyk.io/ |
