zip-slip-vulnerability - Zip Slip Vulnerability (Arbitrary file write throu

项目说明

Zip Slip

<img align="right" src="

Zip Slip is a widespread critical archi , allowing attackers to write arbitrary files on the system, typically resulting in remote command execution. It was discovered and responsibly disclosed by the Snyk Security team ahead of a public disclosure on 5th June 2018, and affects thousands of projects, including ones from HP, Amazon, Apache, Pivotal and many more. This page provides the most up-to-date fix statuses for the libraries and projects that were found to be exploitable or contain a implementation.

For more information on the technical details of Zip Slip, read

The has been found in multiple ecosystems, including Ja, Ruby, .NET and Go, but is especially pre in Ja there is no central library offering high le of archive (e.g. zip) files. The lack of such a library led to code snippets being hand-crafted and shared among de communities such as StackO.

The is exploited using a specially crafted archive that holds directory tra filenames (e.g. ../../evil.sh). The Zip Slip can affect numerous archi, including tar, jar, war, cpio, apk, rar and 7z.

Here is a code example showing a ZipEntry path being concatenated to a destination directory without any path . Code similar to this has been found in many repositories across many ecosystems, including libraries which thousands of applications depend on.

If you find a library or project that contains similar code, we ask for your contribution to this repository to provide the community with the most up to date information about the Zip Slip . To contribute, please refer to our CONTRIBUTING.md file.

Affected Libraries

Many of the following affected libraries exist because their ecosystems lack high level APIs pro the basic archi capabilities. This results in code being shared and reused. The following table contains the list of libraries we found during private disclosure of Zip Slip which we aim to keep up to date, with community support, going forward as more libraries are discovered. Some libraries that do not provide the high-level API often result in implementations also, either through people copying and pasting private code, or writing their own snippets.

| | Product | Language | Confirmed | Fixed | CVE | Fixed |
|----------------|------------------------------------------------------------------------------------------------------------------------|------------|----------------------|------------------------------------------------------------------------------------------|------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| npm library | unzipper | Ja | YES | 0.8.13 | C | 17/4/2018 |
| npm library | adm-zip | Ja | YES | 0.4.9 | C | 23/4/2018 |
| Ja | codehaus/plexus-archiver | Java | YES | 3.6.0 | C | 6/5/2018 |
| Ja | zeroturnaround/zt-zip | Java | YES | 1.13 | C | 26/4/2018 |
| Ja | zip4j | Java | YES | 1.3.3 | C | 13/6/2018 |
| .NET library | DotNetZip.Semverd | .NET | YES | 1.11.0 | C | 7/5/2018 |
| .NET library | SharpCompress | .NET | YES | 0.21.0 | C | 2/5/2018 |
| Oracle | java.util.zip | Java | * No High Level API | Documentation Fix | N/A | |
| Apache | commons-compress | Java | * No High Level API | Documentation Fix | N/A | 23/4/2018 |
| .NET library | SharpZipLib | .NET | YES | v1.0.0 | C | 19/8/2018 |
| Ruby gem | zip-ruby | Ruby | * No High Level API | | N/A | |
| Ruby gem | rubyzip | Ruby | YES | | C | |
| Ruby gem | zipruby | Ruby | * No High Level API | | N/A | |
| Go library | archive | Go | * No High Level API | | N/A | |
| Python library | tarfile | Python | YES | | C | |
| C++/qt library | quazip | C++ | YES | 0.7.6 | C | 12/6/2018 |
| Clojure library| Raynes/fs | Clojure | YES | akvo/fs 20180618-134534.a44cdd5b | N/A | 18/6/2018 |
| Go library | cloudfoundry/archiver | Go | YES | 24/5/2018 | N/A | 24/5/2018 |
| PHP library | chumper/zipper | PHP | YES | 1.0.3 | N/A | 26/2/2020 |
| Perl library | libarchi | Perl | YES | | C | |
| Rust library | rs-async-zip | Rust | * No High Level API | Documentation Fix | N/A | |

Projects Affected and Fixed

The following list of projects contain code. Please add to this list as you find projects that are to Zip Slip, or if you ha information about a project fix status.

| | Product | Fixed date | Fixed | CVE | Code |
|---------------------|-----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|---------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Apache Storm | Storm | 2/5/2018 | 1.1.3, 1.2.2 | C | #1 #2 #3 #4 |
| Apache Software Foundation | Apache Hadoop | 30/5/2018 #1 #2 | 2.7.7, 2.8.5, 2.9.2, 3.0.3, 3.1.1 | C | |
| Apache | Maven | | | | |
| Apache | Ant | 21/4/2018 | 1.9.12 | C | |
| Go library | mholt/archiver| 29/9/2020 | 3.3.2 | C | |
| Pivotal | spring-integration-zip | 3/5/2018 | 1.0.1 | C | |
| Pivotal | spring-integration-zip | 10/5/2018 | 1.0.2 | C | |
| HP | Fortify Cloud Scan Jenkins Plugin | 27/4/2018 | 1.5.2 | | #1 |
| OWASP | DependencyCheck | 7/5/2018 | 3.2.0 | C | |
| Amazon | AWS Toolkit for Eclipse | 31/5/2018 | | | |
| SonarSource | SonarQube | 4/5/2018 | 6.7.4 LTS, 7.2 | | #1 |
| Cinchapi | Concourse | 30/5/2018 | | | #1 |
| Orient Technologies | OrientDB | 31/5/2018 | | | #1 #2 |
| FenixEdu | Academic | 30/5/2018 | | | #1 | |
| Lucee | Lucee | 5/6/2018 | 5.2.7.63, 5.2.8.47 | | #1 | |
| groo | groo | 3/7/2018 | 0.7.1 | | #1 | |
| fabric8 | fabric8 | 5/6/2018 | 2.2.170-85 | | #1 | |
| Apache | Tika | 19/9/2018 | 1.19 | |
| Apache | DeepLearning4J | 10/24/2018 | 1.0.0-SNAPSHOT | |
| |
| FireGiant | WiX Toolkit | 09/19/2019 | 3.11.2 | C |
| |

Defensively fixed but deemed not exploitable

Some projects were confirmed by the project maintainers that their implementation code was not to Zip Slip. However they decided to remove or fix their implementation so that in the future, the snippets could not be copied and become elsewhere.

| | Product | Code Removed | Code |
|-----------------|--------------------|----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Apache | Kylin | 24/4/2018 | #1 |
| Apache | NiFi | 24/4/2018 | #1 |
| Apache | Geode | 20/4/2018 | |
| Jenkins | Jenkins CI | 5/5/2018 | #1 |
| Elastic | ElasticSearch | 10/5/2018 | #1 |
| LinkedIn | Pinot | 22/5/2018 | #1 |
| AnkiDroid | Anki-Droid | 31/5/2018 | #1 |
| ata4 | bspsrc | 30/5/2018 | #1 |
| eirslett | frontend-ma | 30/5/2018 | #1 #2 |

Affected and not yet fixed

| | Product | Code | CVE |
|-----------------|--------------------|------------------------------------------------------------------------------------------------------|---------------|
| unknwon | cae/zip | #1 | C |
| unknwon | cae/tz | #1 | C |

Deemed not exploitable by the maintainer ( implementation remains)

The final list of projects are those with snippets of code that still have a implementation, but are not exploitable. It is believed that it would not be possible to attack these projects in such a way that could lead to a malicious outcome, but the pattern of code still exists within the code base. We strongly encourage such projects to fix the implementation both to prevent its use through other functionality, or use in other projects that copy paste snippets.

| | Product | Code |
|--------------|--------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| JetBrains | Intellij-community | #1 |
| Apache | Apex | #1 |
| Apache | Zeppelin | #1 |
| Apache | Reef | #1 |
| Apache | BookKeeper | #1 |
| Apache | Pulsar | #1 |
| Apache | Heron | #1 |
| Apache | Gobblin | #1 |
| Apache | Gobblin | #1 |
| Apache | SystemML | #1 |
| Gradle | Gradle | #1 |
| Gradle | Gradle | #1 |
| Gradle | Gradle | #1 |
| plasma-umass | doppio | #1 |
| streamsets | DataCollector | #1 |

For more information on Zip Slip, go to

项目信息

开发语言：未知

Star 数：855

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Zip Slip Vulnerability (Arbitrary file write through archive extraction)展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。