CVE-2020-36561: Path Traversal Vulnerability in github.com/yi-ge/unzip
Summary
CVE-2020-36561: Unzip vulnerable to path traversal. Affects github.com/yi-ge/unzip versions < 1.0.3-0.20200308084313-2adbaa4891b9. Fixed in 1.0.3-0.20200308084313-2adbaa4891b9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/yi-ge/unzip is a Go library that provides functionality for extracting files from ZIP archives. It is commonly used in Go applications to handle file compression and decompression tasks. However, a vulnerability has been discovered in the package that allows for path traversal attacks. This means that an attacker can manipulate the file paths in a ZIP archive to write or overwrite files outside of the intended target directory.
Vulnerability Detail
The vulnerability in github.com/yi-ge/unzip arises from improper path sanitization. When processing ZIP archives, the package fails to properly validate and sanitize file paths, allowing for the inclusion of relative paths that can escape the target directory. As a result, an attacker can craft a malicious ZIP archive that, when extracted using the vulnerable library, can write or overwrite files in arbitrary locations on the file system. This can lead to unauthorized access, data leakage, or even remote code execution depending on the context in which the library is used.
How To Fix
Minimum fixed version
1.0.3-0.20200308084313-2adbaa4891b9
This is the first release that contains the fix.
go get github.com/yi-ge/unzip@v1.0.3-0.20200308084313-2adbaa4891b9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of github.com/yi-ge/unzip as soon as possible.
Conclusion
The path traversal vulnerability in github.com/yi-ge/unzip can have serious security implications, allowing attackers to write or overwrite files outside of the intended target directory. It is crucial for developers to update to the fixed version of the package to ensure the secure processing of ZIP archives. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/yi-ge/unzip →
FAQ
The vulnerability allows an attacker to write or overwrite files outside of the target directory when processing ZIP archives using github.com/yi-ge/unzip. This can lead to unauthorized access, data leakage, or remote code execution depending on the context.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to update to the fixed version of github.com/yi-ge/unzip to mitigate the risk of potential attacks.
No, the only way to fully mitigate the risk is to update to the fixed version of github.com/yi-ge/unzip. Patching or modifying the vulnerable code manually may introduce other issues and is not recommended.
You can find more information about this vulnerability, including technical details and the fixed version, in the vulnerability report at https://pkg.go.dev/vuln/GO-2020-0035.
