Zip Slip
Zip Slip is a widespread critical archive extraction vulnerability, allowing attackers to write
arbitrary files on the system, typically resulting in remote command execution. It was
discovered and responsibly disclosed by the Snyk Security team ahead of a public disclosure
on 5th June 2018, and affects thousands of projects, including ones from HP, Amazon, Apache,
Pivotal and many more (CVEs and full list here).
The vulnerability has been found in multiple ecosystems, including JavaScript, Ruby, .NET and
Go, but is especially prevalent in Java, where there is no central library offering high level
processing of archive (e.g. zip) files. The lack of such a library led to vulnerable code snippets
being hand crafted and shared among developer communities such as StackOverflow.
The vulnerability is exploited using a specially crafted archive that holds directory traversal
filenames (e.g. ../../evil.sh). The Zip Slip vulnerability can affect numerous archive formats,
including tar, jar, war, cpio, apk, rar and 7z.
Zip Slip is a form of directory traversal that can be exploited by extracting files from an archive.
The premise of the directory traversal vulnerability is that an attacker can gain access to parts
of the file system outside of the target folder in which they should reside. The attacker can then
overwrite executable files and either invoke them remotely or wait for the system or user to
call them, thus achieving remote command execution on the victim’s machine. The
vulnerability can also cause damage by overwriting configuration files or other sensitive
resources, and can be exploited on both client (user) machines and servers.
资源评论
