PT-2018-9624 · Unzipper · Unzipper

Aviadatsnyk · Published 2018-07-25 · Updated 2019-10-09 · CVE-2018-1002203

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: unzipper versions prior to 0.8.13

Description: The issue allows attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction, also known as 'Zip-Slip'. This can occur when a specifically crafted archive containing path traversal filenames (e.g., ../../file.txt) is extracted.

Recommendations: Update to version 0.8.13 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-1002203

GHSA-884W-698F-927F

Affected Products

Unzipper

References · 11

• 🔥 https://github.com/snyk/zip-slip-vulnerability · Exploit
• 🔥 https://github.com/ZJONSSON/node-unzipper/pull/59 · Exploit
• 🔥 https://snyk.io/vuln/npm:unzipper:20180415 · Exploit
• 🔥 https://snyk.io/research/zip-slip-vulnerability · Exploit
• https://github.com/ZJONSSON/node-unzipper/commit/2220ddd5b58f6252069a4f99f9475441ad0b50cd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-1002203 · Security Note
• https://osv.dev/vulnerability/GHSA-884w-698f-927f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1002203 · Vendor Advisory
• https://npmjs.com/advisories/680 · Note
• https://hackerone.com/reports/362119 · Note
• https://github.com/advisories/GHSA-884w-698f-927f · Note