- Reported
-
- Issued
-
- Package
-
ant-releases
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#path-traversal
#directory-traversal
#zip-slip
#arbitrary-file-write
- References
-
- CVSS Score
- 8.2
HIGH
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- Scope
- Changed
- Confidentiality Impact
- Low
- Integrity Impact
- High
- Availability Impact
- None
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
- Patched
-
no patched versions
- Affected Functions
- Version
ant_releases::AntReleaseRepoActions::extract_release_archive-
Description
ant-releases downloads and unpacks release archives from the safe_network / autonomi repositories. When it extracts an archive, it builds each output path by joining the archive entry's own name onto the destination directory, with no check
for .. or absolute components — a classic "zip-slip" path traversal (CWE-22 / CWE-23). A crafted archive can therefore create or overwrite files outside the intended extraction directory.
In extract_release_archive (src/lib.rs), the ZIP branch does:
let out_path = dest_dir_path.join(file.name()); // raw zip entry name, no containment check
if file.name().ends_with('/') {
std::fs::create_dir_all(&out_path)?; // dir created outside dest_dir
} else {
let mut outfile = std::fs::File::create(&out_path)?; // file written outside dest_dir
std::io::copy(&mut file, &mut outfile)?;
}
Proof of concept
A one-entry ZIP whose entry name is ../foo_pwned.txt, passed to AntReleaseRepoActions::extract_release_archive (obtained via the crate's public <dyn AntReleaseRepoActions>::default_config()), writes foo_pwned.txt as a sibling of
the destination directory, outside it. Confirmed against the published 0.4.3 crate.
Advisory available under CC0-1.0
license.