CVE-2018-1002203: Arbitrary File Write via Archive Extraction in unzipper
Summary
CVE-2018-1002203: Arbitrary File Write via Archive Extraction in unzipper. Affects unzipper versions < 0.8.13. Fixed in 0.8.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The unzipper package is an npm package used for extracting files from archives. It provides functionality to extract files from various archive formats. However, versions of unzipper before 0.8.13 are vulnerable to an arbitrary file write vulnerability. This vulnerability can be exploited when extracting a specially crafted archive that contains path traversal filenames. An example of such a filename is ../../file.txt. This vulnerability allows an attacker to write files to arbitrary locations on the system.
Vulnerability Detail
The vulnerability in unzipper arises from a lack of proper input validation when processing filenames within an archive. By including path traversal sequences in the filenames, an attacker can bypass the intended extraction directory and write files to arbitrary locations on the system. This can lead to various security issues, such as overwriting critical files, executing arbitrary code, or escalating privileges. The vulnerability has a severity rating of HIGH and is classified under CWE-22.
How To Fix
Minimum fixed version
0.8.13
This is the first release that contains the fix.
npm install unzipper@0.8.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the unzipper package to mitigate the risk of arbitrary file write attacks.
Conclusion
The unzipper package versions prior to 0.8.13 are vulnerable to an arbitrary file write vulnerability. This can be exploited by extracting a specially crafted archive containing path traversal filenames. To mitigate the risk, it is crucial to update to version 0.8.13 or later of the unzipper package. This update includes the necessary fixes to prevent path traversal attacks and ensure the system's security. For additional support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for unzipper →
FAQ
This vulnerability allows an attacker to write files to arbitrary locations on the system, which can lead to various security issues such as overwriting critical files, executing arbitrary code, or escalating privileges.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
While there are no known public exploits for this vulnerability, it is still crucial to update to the fixed version of the unzipper package to prevent potential attacks.
No, updating to the fixed version of the unzipper package is the only way to mitigate the risk of arbitrary file write attacks. It is recommended to update as soon as possible.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
