Directory Traversal Vulnerability in JSZip Package
Summary
DEBIAN-CVE-2022-48285: loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive. Affects node-jszip versions < 3.10.0+dfsg-1. Fixed in 3.10.0+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JSZip is a popular JavaScript library used for creating, reading, and editing .zip files in web applications. It provides a simple API for handling ZIP file operations, making it a valuable tool for developers who need to manage compressed file formats. However, prior to version 3.10.0, JSZip was susceptible to a directory traversal vulnerability that could allow attackers to manipulate file paths within ZIP archives.
Vulnerability Detail
The vulnerability, identified as CVE-2022-48285, exists in the loadAsync function of JSZip versions before 3.8.0. It allows for directory traversal via a crafted ZIP archive, potentially enabling an attacker to extract files to arbitrary locations on the server. This could lead to unauthorized access to sensitive files or system compromise, making it a significant security risk for applications utilizing this library.
How To Fix
Minimum fixed version
3.10.0+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-jszipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize ZIP file contents before processing them. This can help mitigate the risk of directory traversal attacks.
Conclusion
The directory traversal vulnerability in the JSZip package poses a significant risk to applications that utilize it. By updating to the patched version and implementing best practices for input validation, developers can protect their applications from potential attacks.
See every vulnerability recorded for node-jszip →
FAQ
A directory traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory structure, potentially leading to unauthorized data access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability could result in unauthorized access to sensitive files, data breaches, or even complete system compromise.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If you cannot update the package right away, implement input validation to sanitize ZIP file contents to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-jszip.
