Arbitrary File Overwrite in decompress-zip
Summary
GHSA-73v8-v6g4-vrpm: Arbitrary File Overwrite in decompress-zip. Affects decompress-zip across 2 version ranges.
< 0.2.2
>= 0.3.0, < 0.3.2
Fixed in 0.2.2 or 0.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The decompress-zip package is an npm package used for extracting files from zip archives. It provides a simple and convenient way to decompress zip files in Node.js applications. However, vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, which is an arbitrary file write vulnerability. This vulnerability arises because decompress-zip fails to verify that extracted files do not resolve to targets outside of the extraction root directory.
Vulnerability Detail
The Zip-Slip vulnerability in decompress-zip allows an attacker to overwrite arbitrary files on the system by crafting a malicious zip archive. By including file paths with '../' or similar directory traversal sequences in the zip file, an attacker can trick decompress-zip into extracting files to unintended locations. This can lead to various security issues, such as overwriting critical system files or injecting malicious code into existing files.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.2.20.2.2npm install decompress-zip@0.2.2 -
>= 0.3.0, < 0.3.20.3.2npm install decompress-zip@0.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed versions of decompress-zip to mitigate the risk of arbitrary file overwrite.
Conclusion
The Zip-Slip vulnerability in decompress-zip exposes applications to the risk of arbitrary file overwrite. To mitigate this vulnerability, it is crucial to upgrade to the latest patched versions of decompress-zip. Additionally, using tools like Vulert can help identify and monitor open-source vulnerabilities in your software. For further support on vulnerability remediation or any other security concerns, feel free to contact DevNack.com.
See every vulnerability recorded for decompress-zip →
FAQ
This vulnerability allows an attacker to overwrite arbitrary files on the system, potentially leading to unauthorized access, data loss, or the execution of malicious code.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, there have been reported instances of attackers exploiting the Zip-Slip vulnerability in other packages. It is important to promptly update to the fixed versions of decompress-zip to prevent potential attacks.
While it is possible to manually validate the extracted file paths, it is highly recommended to upgrade to the fixed versions of decompress-zip instead. The fixed versions implement proper validation techniques to prevent directory traversal attacks.
For further support on vulnerability remediation or any other security concerns, you can reach out to info@devnack.com. Our team of experts will be happy to assist you.
