CVE-2021-23484: Arbitrary File Write via Archive Extraction in zip-local

Background

The zip-local package is an npm package that provides functionality for working with zip archives in Node.js. It allows users to create, extract, and manipulate zip files. The package is commonly used in applications that require file compression and decompression capabilities. However, versions of zip-local before 0.3.5 are vulnerable to an Arbitrary File Write via Archive Extraction (Zip Slip) attack. This vulnerability allows an attacker to craft a malicious zip file that, when extracted using the zip-local library, can write files to arbitrary locations on the file system, potentially leading to unauthorized access or code execution.

Vulnerability Detail

The vulnerability in zip-local arises from a lack of proper validation of file paths during the extraction process. When a zip file is extracted using the vulnerable versions of zip-local, the library does not adequately check if the extracted files are being written to the intended extraction directory. This allows an attacker to craft a zip file with specially crafted file paths that can traverse directories and write files to arbitrary locations on the file system. The consequences of this vulnerability can be severe, as it can lead to unauthorized access to sensitive files or the execution of arbitrary code.

npm install zip-local@0.3.5

Workaround

If upgrading to the latest version of zip-local is not immediately feasible, a temporary workaround is to implement additional validation of file paths before extracting zip files using the zip-local library. This can be done by checking if the extracted file paths are within the intended extraction directory and rejecting any files that are outside this directory. Here is an example of how this can be implemented in Node.js:

const zip = require('zip-local');

function extractZipFile(zipFilePath, extractionDirectory) {
  const files = zip.sync.unzip(zipFilePath);

  files.forEach(file => {
    const extractedFilePath = file.name;
    const absoluteFilePath = path.resolve(extractionDirectory, extractedFilePath);

    if (!absoluteFilePath.startsWith(extractionDirectory)) {
      throw new Error('Invalid file path: ' + extractedFilePath);
    }

    // Extract the file
    file.extract(extractionDirectory);
  });
}

Conclusion

The vulnerability in zip-local before version 0.3.5 allows for arbitrary file write via archive extraction, potentially leading to unauthorized access or code execution. It is recommended to upgrade to version 0.3.5 or later to fix this vulnerability. If immediate upgrade is not possible, implementing additional validation of file paths can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for zip-local →

FAQ