| 제목 | ZJONSSON node-unzipper 0.12.3 Path Traversal |
|---|
| 설명 | A path traversal / Zip Slip vulnerability exists in ZJONSSON/node-unzipper, npm package unzipper, version 0.12.3.
The vulnerability is caused by unsafe extraction path validation. The affected code builds the destination path with path.join() and then checks whether the resulting path starts with the configured extraction directory using a raw string-prefix comparison:
extractPath.indexOf(opts.path) != 0
This is not a proper directory-boundary check. If the intended extraction directory is named "out", a crafted ZIP entry such as "../out2/evil.txt" resolves to the sibling directory "out2". The resulting path still begins with the string prefix of the configured extraction path, so the check passes even though the file is outside the intended extraction directory.
The issue affects at least the following extraction APIs:
unzipper.Extract({ path })
Open.*.extract({ path })
The PoC creates a ZIP archive containing one file entry:
../out2/evil.txt
The archive is extracted into:
_local_prefix_poc/out
Expected result:
The entry should be rejected because it resolves outside the configured extraction root.
Actual result:
The file is written outside the extraction root into the sibling directory:
_local_prefix_poc/out2/evil.txt
Observed PoC output:
escaped_exists=true
inside_exists=false
escaped_content=NODE_UNZIPPER_PREFIX_TRAVERSAL
Successful exploitation allows an attacker to write files outside the intended ZIP extraction directory when a vulnerable application extracts attacker-controlled ZIP archives. Depending on the application deployment, this may allow writing to sibling directories, overwriting application-controlled files, placing attacker-controlled files in web-served directories, or potentially achieving code execution if the written file is later loaded or executed by the application.
Suggested fix:
The vulnerable string-prefix check should be replaced with canonical path resolution and directory-boundary validation using path.resolve() and path.relative(). The destination should only be accepted if it remains inside the configured extraction root.
Estimated severity:
High. Suggested CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, score 8.1.
For more POC details, please see my issue: https://github.com/ZJONSSON/node-unzipper/issues/357 |
|---|
| 원천 | ⚠️ https://github.com/ZJONSSON/node-unzipper/issues/357 |
|---|
| 사용자 | zyhhoward (UID 97563) |
|---|
| 제출 | 2026. 06. 18. AM 05:41 (1 월 ago) |
|---|
| 모더레이션 | 2026. 07. 27. AM 09:18 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 383384 [ZJONSSON node-unzipper 까지 0.12.3 lib/extract.js Extract 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|