CVE-2018-1002209 (published 2018-07-25T17:29Z)

QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/stachenov/quazip
commit_details: repo_url: https://github.com/stachenov/quazip
author: Sergei Tachenov
author_date: 2018-06-12 21:32:45+03:00
msg: Fixed the Zip Slip vulnerability in JlCompress

When extracting a file with a dangerous path like "../evil.exe"
from a ZIP archive with JlCompress::extractDir(), the target
file would be created outside of the target directory, potentially
even overwriting an existing file there.
repository: repo_url: https://github.com/stachenov/quazip
repo_name: stachenov/quazip
description: Qt/C++ wrapper over minizip
repo_language: C++
owner: stachenov
file_changes: filename: NEWS.txt
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,8 @@
 QuaZIP changes
 
+* Current
+        * Fixed the Zip Slip vulnerability in JlCompress
+
 * 0.7.5
         * Fixed target_link_libraries call in CMakeLists
         * Worked around a Qt 4.6 bug (QTBUG-15421) screwing up hidden

programming_language: Markdown
filename: JlCompress.cpp
change_type: ModificationType.MODIFY
diff: @@ -364,8 +364,9 @@ QStringList JlCompress::extractDir(QuaZip &zip, const QString &dir)
     if(!zip.open(QuaZip::mdUnzip)) {
         return QStringList();
     }
-
-    QDir directory(dir);
+    QString cleanDir = QDir::cleanPath(dir);
+    QDir directory(cleanDir);
+    QString absCleanDir = directory.absolutePath();
     QStringList extracted;
     if (!zip.goToFirstFile()) {
         return QStringList();
@@ -373,6 +374,9 @@ QStringList JlCompress::extractDir(QuaZip &zip, const QString &dir)
     do {
         QString name = zip.getCurrentFileName();
         QString absFilePath = directory.absoluteFilePath(name);
+        QString absCleanPath = QDir::cleanPath(absFilePath);
+        if (!absCleanPath.startsWith(absCleanDir + "/"))
+            continue;
         if (!extractFile(&zip, "", absFilePath)) {
             removeFile(extracted);
             return QStringList();

programming_language: C++
filename: testjlcompress.cpp
change_type: ModificationType.MODIFY
diff: @@ -302,17 +302,25 @@ void TestJlCompress::extractDir_data()
 {
     QTest::addColumn<QString>("zipName");
     QTest::addColumn<QStringList>("fileNames");
-    QTest::newRow("simple") << "jlextdir.zip" << (
-            QStringList() << "test0.txt" << "testdir1/test1.txt"
+    QTest::addColumn<QStringList>("expectedExtracted");
+    QTest::newRow("simple") << "jlextdir.zip"
+        << (QStringList() << "test0.txt" << "testdir1/test1.txt"
+            << "testdir2/test2.txt" << "testdir2/subdir/test2sub.txt")
+        << (QStringList() << "test0.txt" << "testdir1/test1.txt"
             << "testdir2/test2.txt" << "testdir2/subdir/test2sub.txt");
-    QTest::newRow("separate dir") << "sepdir.zip" << (
-            QStringList() << "laj/" << "laj/lajfile.txt");
+    QTest::newRow("separate dir") << "sepdir.zip"
+        << (QStringList() << "laj/" << "laj/lajfile.txt")
+        << (QStringList() << "laj/" << "laj/lajfile.txt");
+    QTest::newRow("Zip Slip") << "zipslip.zip"
+        << (QStringList() << "test0.txt" << "../zipslip.txt")
+        << (QStringList() << "test0.txt");
 }
 
 void TestJlCompress::extractDir()
 {
     QFETCH(QString, zipName);
     QFETCH(QStringList, fileNames);
+    QFETCH(QStringList, expectedExtracted);
     QDir curDir;
     if (!curDir.mkpath("jlext/jldir")) {
         QFAIL("Couldn't mkpath jlext/jldir");
@@ -325,9 +333,10 @@ void TestJlCompress::extractDir()
     }
     QStringList extracted;
     QCOMPARE((extracted = JlCompress::extractDir(zipName, "jlext/jldir"))
-        .count(), fileNames.count());
-    foreach (QString fileName, fileNames) {
-        QString fullName = "jlext/jldir/" + fileName;
+        .count(), expectedExtracted.count());
+    const QString dir = "jlext/jldir/";
+    foreach (QString fileName, expectedExtracted) {
+        QString fullName = dir + fileName;
         QFileInfo fileInfo(fullName);
         QFileInfo extInfo("tmp/" + fileName);
         if (!fileInfo.isDir())
@@ -335,7 +344,7 @@ void TestJlCompress::extractDir()
         QCOMPARE(fileInfo.permissions(), extInfo.permissions());
         curDir.remove(fullName);
         curDir.rmpath(fileInfo.dir().path());
-        QString absolutePath = fileInfo.absoluteFilePath();
+        QString absolutePath = QDir(dir).absoluteFilePath(fileName);
         if (fileInfo.isDir() && !absolutePath.endsWith('/'))
 	    absolutePath += '/';
         QVERIFY(extracted.contains(absolutePath));
@@ -344,9 +353,9 @@ void TestJlCompress::extractDir()
     QFile zipFile(zipName);
     QVERIFY(zipFile.open(QIODevice::ReadOnly));
     QCOMPARE((extracted = JlCompress::extractDir(&zipFile, "jlext/jldir"))
-        .count(), fileNames.count());
-    foreach (QString fileName, fileNames) {
-        QString fullName = "jlext/jldir/" + fileName;
+        .count(), expectedExtracted.count());
+    foreach (QString fileName, expectedExtracted) {
+        QString fullName = dir + fileName;
         QFileInfo fileInfo(fullName);
         QFileInfo extInfo("tmp/" + fileName);
         if (!fileInfo.isDir())
@@ -354,7 +363,7 @@ void TestJlCompress::extractDir()
         QCOMPARE(fileInfo.permissions(), extInfo.permissions());
         curDir.remove(fullName);
         curDir.rmpath(fileInfo.dir().path());
-        QString absolutePath = fileInfo.absoluteFilePath();
+        QString absolutePath = QDir(dir).absoluteFilePath(fileName);
         if (fileInfo.isDir() && !absolutePath.endsWith('/'))
         absolutePath += '/';
         QVERIFY(extracted.contains(absolutePath));

programming_language: C++