| Título | moxi159753 mogu_blog_v2 <=v5.2 Path Traversal / Zip Slip |
|---|
| Descrição | mogu_blog_v2, a microservice-based blog system, contains a Zip Slip path traversal vulnerability in the network disk file decompression functionality. The /networkDisk/unzipFile endpoint calls FileOperation.unzip() which extracts ZIP archives without validating entry names. At line 241 of FileOperation.java, file paths are constructed directly as new File(destDirPath + "/" + entry.getName()) without checking for path traversal sequences or ensuring the resolved canonical path remains within the target directory. Authenticated attackers with network disk access can upload malicious ZIP files containing entries with names like ../../../../config/application.yml or ../../../../tmp/malicious.sh. When the ZIP is extracted, these files are written to arbitrary filesystem locations, escaping the intended extraction directory. This enables attackers to overwrite critical application configuration files, deploy webshells to web-accessible directories, modify executable scripts, or write to system locations, leading to remote code execution and complete system compromise. The vulnerability requires authentication but allows low-privileged users to achieve code execution through arbitrary file write. |
|---|
| Fonte | ⚠️ https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-zip_slip-1/report.md |
|---|
| Utilizador | sh7err05 (UID 92498) |
|---|
| Submissão | 10/11/2025 14h39 (há 11 meses) |
|---|
| Moderação | 30/11/2025 20h51 (20 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 333825 [moxi159753 Mogu Blog v2 até 5.2 ZIP File /networkDisk/unzipFile FileOperation.unzip fileUrl Travessia de Diretório] |
|---|
| Pontos | 20 |
|---|