Arbitrary file access during archive extraction (”Zip Slip”)¶
ID: java/zipslipKind: path-problemSecurity severity: 7.5Severity: errorPrecision: highTags: - security - external/cwe/cwe-022Query suites: - java-code-scanning.qls - java-security-extended.qls - java-security-and-quality.qls
Click to see the query in the CodeQL repository
Extracting files from a malicious zip file, or similar type of archive, is at risk of directory traversal attacks if filenames from the archive are not properly validated.
Zip archives contain archive entries representing each file in the archive. These entries include a file path for the entry, but these file paths are not restricted and may contain unexpected special elements such as the directory traversal element (..). If these file paths are used to create a filesystem path, then a file operation may happen in an unexpected location. This can result in sensitive information being revealed or deleted, or an attacker being able to influence behavior by modifying unexpected files.
For example, if a zip file contains a file entry..\sneaky-file, and the zip file is extracted to the directoryc:\output, then naively combining the paths would result in an output file path ofc:\output\..\sneaky-file, which would cause the file to be written toc:\sneaky-file.
Recommendation¶
Ensure that output paths constructed from zip archive entries are validated to prevent writing files to unexpected locations.
The recommended way of writing an output file from a zip archive entry is to verify that the normalized full path of the output file starts with a prefix that matches the destination directory. Path normalization can be done with eitherjava.io.File.getCanonicalFile() orjava.nio.file.Path.normalize(). Prefix checking can be done withString.startsWith(..), but it is better to usejava.nio.file.Path.startsWith(..), as the latter works on complete path segments.
Another alternative is to validate archive entries against a whitelist of expected files.
Example¶
In this example, a file path taken from a zip archive item entry is combined with a destination directory. The result is used as the destination file path without verifying that the result is within the destination directory. If provided with a zip file containing an archive path like..\sneaky-file, then this file would be written outside the destination directory.
voidwriteZipEntry(ZipEntryentry,FiledestinationDir){Filefile=newFile(destinationDir,entry.getName());FileOutputStreamfos=newFileOutputStream(file);// BAD// ... write entry to fos ...}
To fix this vulnerability, we need to verify that the normalizedfile still hasdestinationDir as its prefix, and throw an exception if this is not the case.
voidwriteZipEntry(ZipEntryentry,FiledestinationDir){Filefile=newFile(destinationDir,entry.getName());if(!file.toPath().normalize().startsWith(destinationDir.toPath()))thrownewException("Bad zip entry");FileOutputStreamfos=newFileOutputStream(file);// OK// ... write entry to fos ...}
References¶
Snyk:Zip Slip Vulnerability.
OWASP:Path Traversal.
Common Weakness Enumeration:CWE-22.