PT-2018-9624 · Unzipper · Unzipper

Aviadatsnyk · Publicado 2018-07-25 · Atualizado 2019-10-09 · CVE-2018-1002203

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: unzipper versions prior to 0.8.13

Description: The issue allows attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction, also known as 'Zip-Slip'. This can occur when a specifically crafted archive containing path traversal filenames (e.g., ../../file.txt) is extracted.

Recommendations: Update to version 0.8.13 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-1002203

GHSA-884W-698F-927F

Produtos afetados

Unzipper

Referências · 11

• 🔥 https://github.com/snyk/zip-slip-vulnerability · Exploit
• 🔥 https://github.com/ZJONSSON/node-unzipper/pull/59 · Exploit
• 🔥 https://snyk.io/vuln/npm:unzipper:20180415 · Exploit
• 🔥 https://snyk.io/research/zip-slip-vulnerability · Exploit
• https://github.com/ZJONSSON/node-unzipper/commit/2220ddd5b58f6252069a4f99f9475441ad0b50cd · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-1002203 · Nota de Segurança
• https://npmjs.com/advisories/680 · Nota
• https://hackerone.com/reports/362119 · Nota
• https://github.com/advisories/GHSA-884w-698f-927f · Nota
• https://osv.dev/vulnerability/GHSA-884w-698f-927f · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1002203 · Aviso do Fabricante