| タイトル | peerigon / unzip-crx-3 (open source, unmaintained) unzip-crx-3 (npm) CRX/ZIP extraction library <=0.2.0 Path Traversal |
|---|
| 説明 | A path traversal (Zip Slip) vulnerability was identified in unzip-crx-3 (npm) up to and including version 0.2.0 (the only/last release, 2022-05-22; no fixed version exists) and in the upstream peerigon/unzip-crx (identical code at HEAD). Affected is the exported unzip(crxFilePath, destination) function in dist/index.js (upstream src/index.js). Archive entry names are taken verbatim from the ZIP central directory and joined with the destination via path.join(destination, filename), then written with mkdir()+writeFile(), with NO containment check (no path.resolve(...).startsWith(destination + path.sep) or realpath verification).
jszip.loadAsync() normalizes only forward-slash '../' segments, so POSIX traversal is neutralized, but backslash segments survive verbatim; on Windows, path.join(destination, '..\\evil.txt') resolves ABOVE the destination directory, so a crafted .crx/.zip writes attacker-controlled files outside the intended extraction folder. Because crxToZip() passes any buffer beginning with the ZIP magic (PK\x03\x04) through unchanged, a plain crafted ZIP renamed to .crx suffices (no CRX signing needed). Scope is Windows-only; the working escape is relative backslash climbing. Impact is integrity / arbitrary file write.
Proof of concept (benign, local, Windows): a hand-built one-entry STORED zip whose central-directory entry name is '..\\ZIPSLIP_PWNED.txt', renamed to .crx and extracted into an empty safe_extract_dir, writes the marker file one directory ABOVE the destination; the control case '../ZIPSLIP_PWNED.txt' is normalized by jszip and stays inside. Reproduced on Windows 10, Node.js v24, unzip-crx-3 0.2.0 with jszip 3.10.1.
Suggested fix: before mkdir/writeFile, reject any entry whose resolved path escapes the destination (path.resolve containment check); also normalize backslashes to forward slashes and skip absolute-path entries.
CVSS 3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (Base 5.4). CWE-22.
Public reference (coordinated disclosure): https://github.com/peerigon/unzip-crx/issues/19
npm: https://www.npmjs.com/package/unzip-crx-3
Researcher: Mykhailo Kholiev. |
|---|
| ソース | ⚠️ https://github.com/peerigon/unzip-crx/issues/19 |
|---|
| ユーザー | Anonymous User |
|---|
| 送信 | 2026年07月11日 13:13 (1 月 ago) |
|---|
| モデレーション | 2026年08月25日 01:03 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 394865 [peerigon unzip-crx/unzip-crx-3 迄 0.2.0 Archive Extraction dist/index.js unzip destination ディレクトリトラバーサル] |
|---|
| ポイント | 20 |
|---|