CVE-2024-24043: Insufficient Information (NVD-CWE-noinfo)
value: Directory Traversal vulnerability in Speedy11CZ MCRPX v.1.4.0 and before allows a local attacker to execute arbitrary code via a crafted file.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-19T07:15Z
Repository: https://github.com/Speedy11CZ/mcrpx
Language: Other
Files changed: common/src/main/java/cz/speedy11/mcrpx/common/util/ZipUtil.java, gradle.properties
Commit date: 2024-01-15 10:06:53 +0100
Commit message: Hotfix for path traversal vulnerability

Diff: diff --git a/common/src/main/java/cz/speedy11/mcrpx/common/util/ZipUtil.java b/common/src/main/java/cz/speedy11/mcrpx/common/util/ZipUtil.java
index 057ed1e..2c0cb52 100644
--- a/common/src/main/java/cz/speedy11/mcrpx/common/util/ZipUtil.java
+++ b/common/src/main/java/cz/speedy11/mcrpx/common/util/ZipUtil.java
@@ -97,10 +97,15 @@ public class ZipUtil {
             Enumeration<? extends ZipEntry> zipEntries = zipFile.entries();
             listener.onMessage("Extracting resource pack " + file.getName() + " to directory " + destDirectory.getName());
             int elementCount = 0;
             while (zipEntries.hasMoreElements()) {
                 ZipEntry zipEntry = zipEntries.nextElement();
+                if (zipEntry.getName().contains("..")) {
+                    listener.onMessage("Skipping " + zipEntry.getName() + ": Invalid path");
+                    continue;
+                }
+
                 try {
                     listener.onMessage("Extracting " + zipEntry.getName());
                     try (InputStream entryInputStream = zipFile.getInputStream(zipEntry)) {
                         String filePath = destDirectory + File.separator + zipEntry.getName();
                         File zipEntryFile = new File(filePath);
@@ -139,10 +144,15 @@ public class ZipUtil {
             Enumeration<? extends JarEntry> jarEntries = jarFile.entries();
             listener.onMessage("Extracting resource pack from Minecraft " + file.getName() + " to directory " + destDirectory.getName());
             int elementCount = 0;
             while (jarEntries.hasMoreElements()) {
                 JarEntry jarEntry = jarEntries.nextElement();
+                if (jarEntry.getName().contains("..")) {
+                    listener.onMessage("Skipping " + jarEntry.getName() + ": Invalid path");
+                    continue;
+                }
+
                 if (jarEntry.getName().startsWith("assets/") && !jarEntry.isDirectory()) {
                     listener.onMessage("Extracting " + jarEntry.getName());
                     try (InputStream entryInputStream = jarFile.getInputStream(jarEntry)) {
                         String filePath = destDirectory + File.separator + jarEntry.getName();
                         File jarEntryFile = new File(filePath);
diff --git a/gradle.properties b/gradle.properties
index 871c6ee..b259587 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -1,7 +1,7 @@
 # Project properties
-projectDescription=Core library for plugins used by ketchup plugins, developed by Rajce.pro.
-projectVersion=1.4.0
+projectDescription=MCRPX is a tool to extract files from Minecraft: Java Edition resource packs into selected directory. It can also bypass corrupted resource packs, used by servers to protect their resource packs.
+projectVersion=1.4.1
 # Gradle properties
 org.gradle.daemon=true
 org.gradle.configureondemand=true
 org.gradle.parallel=true
\ No newline at end of file

Vulnerable code: projectDescription=Core library for plugins used by ketchup plugins, developed by Rajce.pro.
projectVersion=1.4.0
Fixed code:                 if (zipEntry.getName().contains("..")) {
                    listener.onMessage("Skipping " + zipEntry.getName() + ": Invalid path");
                    continue;
                }

                if (jarEntry.getName().contains("..")) {
                    listener.onMessage("Skipping " + jarEntry.getName() + ": Invalid path");
                    continue;
                }

projectDescription=MCRPX is a tool to extract files from Minecraft: Java Edition resource packs into selected directory. It can also bypass corrupted resource packs, used by servers to protect their resource packs.
projectVersion=1.4.1