- Reported
-
- Issued
-
- Package
-
sn-releases
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#zip-slip
#path-traversal
#directory-traversal
#arbitrary-file-write
- References
-
- CVSS Score
- 8.8
HIGH
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- Scope
- Unchanged
- Confidentiality Impact
- High
- Integrity Impact
- High
- Availability Impact
- High
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Patched
-
no patched versions
- Affected Functions
- Version
sn_releases::SafeReleaseRepoActions::extract_release_archive-
Description
SafeReleaseRepoActions::extract_release_archive builds each output path from the raw archive entry name and writes to it with no traversal check, so a malicious release archive can create directories and write files outside the destination directory, a "zip-slip" / path traversal (CWE-22 / CWE-23).
In src/lib.rs (extract_release_archive, zip branch):
let mut file = archive.by_index(i)?;
let out_path = dest_dir_path.join(file.name()); // file.name() is the raw entry name
if file.name().ends_with('/') {
std::fs::create_dir_all(&out_path)?; // no `..` check
} else {
let mut outfile = std::fs::File::create(&out_path)?; // writes outside dest
std::io::copy(&mut file, &mut outfile)?;
}
The crate is unmaintained (latest release 0.3.1, 2024-10-22) and no fixed version is available.
Advisory available under CC0-1.0
license.