CVE-2018-1002202: Improper Limitation of a Pathname to a Restricted Directory in Zip4j
Summary
CVE-2018-1002202: Improper Limitation of a Pathname to a Restricted Directory in Zip4j. Affects net.lingala.zip4j:zip4j versions < 1.3.3. Fixed in 1.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zip4j is a Java library for creating, extracting, and modifying ZIP files. It provides functionality to handle various compression methods and encryption algorithms. The library is widely used in Java applications for working with ZIP archives. However, versions prior to 1.3.3 are vulnerable to a directory traversal attack, also known as 'Zip-Slip'. This vulnerability allows attackers to write to arbitrary files by exploiting a mishandling of the '../' (dot dot slash) sequence in a Zip archive entry during extraction.
Vulnerability Detail
The vulnerability in Zip4j arises from improper limitation of a pathname to a restricted directory. By including the '../' sequence in a Zip archive entry, an attacker can traverse directories and write files to arbitrary locations on the file system. This can lead to unauthorized modification or disclosure of sensitive data, as well as potential code execution if the attacker can place malicious files in executable locations. The vulnerability has a CVSSv3 score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.3.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of zip4j is not immediately feasible, a temporary workaround is to implement input validation and sanitization when processing file paths from user input. This can be done by checking for the presence of '../' sequences and ensuring that the extracted file paths are within the intended directory. Here is an example of how to perform input validation in Java:
String inputPath = getUserInput();
if (inputPath.contains("../")) {
// Handle invalid input
throw new IllegalArgumentException("Invalid file path");
}
// Process the file path
Conclusion
The vulnerability in Zip4j allows attackers to write to arbitrary files on the file system by exploiting a directory traversal issue. To mitigate this vulnerability, it is crucial to upgrade to version 1.3.3 or later of the zip4j library and implement proper input validation and sanitization when working with file paths. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for net.lingala.zip4j:zip4j →
FAQ
Zip4j is a Java library for creating, extracting, and modifying ZIP files. It provides functionality to handle various compression methods and encryption algorithms.
Directory traversal, also known as path traversal, is a vulnerability that allows an attacker to access files and directories outside of the intended directory. It occurs when insufficient input validation is performed on file paths.
The vulnerability in Zip4j allows attackers to write to arbitrary files on the file system. This can lead to unauthorized modification or disclosure of sensitive data, as well as potential code execution if the attacker can place malicious files in executable locations.
To fix this vulnerability, it is recommended to upgrade to version 1.3.3 or later of the zip4j library. Additionally, developers should validate and sanitize user-supplied input when working with file paths to prevent directory traversal attacks.
If upgrading to the latest version of zip4j is not immediately feasible, a temporary workaround is to implement input validation and sanitization when processing file paths from user input.
References
Related vulnerabilities
Recent vulnerabilities recorded for net.lingala.zip4j:zip4j.
