CodeQL documentation
CodeQL resources

Arbitrary file access during archive extraction (”Zip Slip”)

ID: js/zipslip Kind: path-problem Security severity: 7.5 Severity: error Precision: high Tags: - security - external/cwe/cwe-022 Query suites: - javascript-code-scanning.qls - javascript-security-extended.qls - javascript-security-and-quality.qls

Click to see the query in the CodeQL repository

Extracting files from a malicious zip file, or similar type of archive, is at risk of directory traversal attacks if filenames from the archive are not properly validated. archive paths.

Zip archives contain archive entries representing each file in the archive. These entries include a file path for the entry, but these file paths are not restricted and may contain unexpected special elements such as the directory traversal element (..). If these file paths are used to create a filesystem path, then a file operation may happen in an unexpected location. This can result in sensitive information being revealed or deleted, or an attacker being able to influence behavior by modifying unexpected files.

For example, if a zip file contains a file entry ..\sneaky-file, and the zip file is extracted to the directory c:\output, then naively combining the paths would result in an output file path of c:\output\..\sneaky-file, which would cause the file to be written to c:\sneaky-file.

Recommendation

Ensure that output paths constructed from zip archive entries are validated to prevent writing files to unexpected locations.

The recommended way of writing an output file from a zip archive entry is to check that ".." does not occur in the path.

Example

In this example an archive is extracted without validating file paths. If archive.zip contained relative paths (for instance, if it were created by something like ziparchive.zip../file.txt) then executing this code could write to locations outside the destination directory.

constfs=require('fs');constunzip=require('unzip');fs.createReadStream('archive.zip').pipe(unzip.Parse()).on('entry',entry=>{constfileName=entry.path;// BAD: This could write any file on the filesystem.entry.pipe(fs.createWriteStream(fileName));});

To fix this vulnerability, we need to check that the path does not contain any ".." elements in it.

constfs=require('fs');constunzip=require('unzip');fs.createReadStream('archive.zip').pipe(unzip.Parse()).on('entry',entry=>{constfileName=entry.path;// GOOD: ensures the path is safe to write to.if(fileName.indexOf('..')==-1){entry.pipe(fs.createWriteStream(fileName));}else{console.log('skipping bad path',fileName);}});

References

close