CVE-2018-1002204: Arbitrary File Write in adm-zip
Summary
CVE-2018-1002204: Arbitrary File Write in adm-zip. Affects adm-zip versions < 0.4.11. Fixed in 0.4.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
adm-zip is an npm package that provides a way to create, extract, and modify ZIP archives. It is commonly used in Node.js applications to handle file compression and decompression. However, versions of adm-zip prior to 0.4.9 are vulnerable to an arbitrary file write vulnerability. This vulnerability allows an attacker to write files to arbitrary locations on the file system by exploiting path traversal filenames in a specially crafted archive. For example, an attacker could include a filename like '../../file.txt' to traverse directories and overwrite sensitive files.
Vulnerability Detail
The arbitrary file write vulnerability in adm-zip can have severe consequences. An attacker with the ability to provide a malicious archive file could overwrite critical files on the system, potentially leading to unauthorized access, data loss, or even remote code execution. This vulnerability is classified as CWE-22, which refers to path traversal vulnerabilities. It was first published on July 27, 2018, and has a severity rating of HIGH.
How To Fix
Minimum fixed version
0.4.11
This is the first release that contains the fix.
npm install adm-zip@0.4.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The arbitrary file write vulnerability in adm-zip can have serious consequences for applications using vulnerable versions of the package. It is crucial to update adm-zip to version 0.4.9 or later to mitigate the risk of unauthorized file writes. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for adm-zip →
FAQ
adm-zip is an npm package used for handling ZIP archives in Node.js applications.
The vulnerability allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized access, data loss, or remote code execution.
Updating adm-zip to version 0.4.9 or later will fix the vulnerability.
No specific workaround is mentioned for this vulnerability. Updating the package is the recommended solution.
The vulnerability was first published in 2018, and there is no information available regarding active exploitation. However, it is always recommended to apply security updates as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for adm-zip.
