CVE-2018-1002201: Improper Limitation of a Pathname to a Restricted Directory in zt-zip
Summary
CVE-2018-1002201: Improper Limitation of a Pathname to a Restricted Directory in zt-zip. Affects org.zeroturnaround:zt-zip versions < 1.13. Fixed in 1.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The zt-zip package is a Maven package that provides functionality for working with Zip archives. It allows users to create, extract, and manipulate Zip files. The package is widely used in various software applications.
Vulnerability Detail
The zt-zip package before version 1.13 is vulnerable to a directory traversal attack, also known as 'Zip-Slip'. This vulnerability allows attackers to write to arbitrary files by exploiting a mishandling of Zip archive entries during extraction. By including a '../' (dot dot slash) sequence in a Zip archive entry, an attacker can traverse directories and overwrite files outside of the intended extraction path. This can lead to unauthorized modification or disclosure of sensitive data.
How To Fix
Minimum fixed version
1.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of zt-zip to mitigate the risk of exploitation.
Conclusion
The zt-zip package before version 1.13 is vulnerable to a directory traversal attack, allowing attackers to write to arbitrary files. To mitigate this risk, it is recommended to update to zt-zip version 1.13 or later. Developers should also ensure that their Maven dependencies are up to date. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.zeroturnaround:zt-zip →
FAQ
zt-zip is a Maven package that provides functionality for working with Zip archives.
A directory traversal attack is a type of vulnerability that allows an attacker to access files and directories outside of the intended scope.
'Zip-Slip' is a term used to describe the directory traversal vulnerability specifically in the context of Zip archive extraction.
This vulnerability can lead to unauthorized modification or disclosure of sensitive data, as attackers can overwrite files outside of the intended extraction path.
To protect your application, it is crucial to update to the fixed version of zt-zip (1.13 or later) and ensure that your Maven dependencies are up to date.
References
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.