Описание
All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a regular file - the file content is written through the symlink to the target location outside the output directory. This is due to the microtask processing order that checks readlink for the second file before resolving symlink for the first file. An attacker can write arbitrary file on the host filesystem potentially leading to remote code execution by providing a specially crafted ZIP archive.
Note:
This bypasses all existing path traversal protections including preventWritingThroughSymlink, added as a part of the fix for CVE-2020-12265.
A flaw was found in the decompress package. A remote attacker can exploit this by providing a crafted ZIP archive with two entries at the same path: a symlink to an arbitrary target and a regular file. Due to microtask processing order, the file content is written through the symlink before it is resolved, allowing writes outside the output directory. This Zip Slip bypasses path traversal protections including preventWritingThroughSymlink (CVE-2020-12265) and can lead to remote code execution.
Отчет
The decompress package is vulnerable to arbitrary file write via Zip Slip when extracting a crafted ZIP containing a symlink and regular file at the same path. Microtask ordering checks readlink on the second entry before resolving the first symlink, bypassing preventWritingThroughSymlink and prior CVE-2020-12265 protections. An attacker who can supply a malicious archive for extraction may write files outside the intended output directory, potentially leading to remote code execution on the host.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | redhat-user-workloads/volsync-0-12 | Will not fix | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | redhat-user-workloads/volsync-bundle-0-12 | Will not fix | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-operator-bundle | Will not fix | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-rhel9 | Will not fix | ||
| Red Hat Build of Keycloak | decompress | Will not fix | ||
| Red Hat Enterprise Linux 8 | dotnet8.0 | Not affected | ||
| Red Hat Hardened Images | dotnet8.0 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a regular file - the file content is written through the symlink to the target location outside the output directory. This is due to the microtask processing order that checks readlink for the second file before resolving symlink for the first file. An attacker can write arbitrary file on the host filesystem potentially leading to remote code execution by providing a specially crafted ZIP archive. **Note:** This bypasses all existing path traversal protections including preventWritingThroughSymlink, added as a part of the fix for [CVE-2020-12265](https://security.snyk.io/vuln/SNYK-JS-DECOMPRESS-557358).
decompress: Arbitrary File Write via Archive Extraction (Zip Slip)
EPSS
7.5 High
CVSS3