[NEW VULNERABILITY] decompress-zip: GHSA-73v8-v6g4-vrpm Fix Bypass + 4 Additional Vulnerabilities

未关闭

#9,724 创建于 2026年9月23日 1 条评论 0 个 reaction 已指派 0 人在 GitHub 查看

还没有人认领这个 Issue。

评估

难度: 4/5
预计耗时: 3-5 天
新手友好度: 30/100

Issue 类型: 缺陷
描述清晰度: 描述清楚
活跃度: 活跃
技术栈: javascript
领域: security

调研方向

The vulnerability is in lib/decompress-zip.js line 94, where indexOf() is used for path validation. Review the decompress-zip package source, understand the zip extraction flow, and test the bypass with a malicious zip file. The fix must properly resolve and contain paths, not just do string prefix matching. Check for similar issues in the codebase and ensure the fix addresses all listed CVEs.

由索引模型根据 Issue 内容生成。

描述

Package Information

Ecosystem: npm
Package: decompress-zip
Affected versions: <= 0.3.3
CWE: CWE-22, CWE-770, CWE-409, CWE-345, CWE-367

Summary

The security fix in v0.3.2 for GHSA-73v8-v6g4-vrpm is INCOMPLETE and can be bypassed. Additionally, 4 new vulnerabilities were discovered.

#	Vulnerability	CVSS 3.1	CWE
1	Path Traversal Fix Bypass	9.1 CRITICAL	CWE-22
2	Memory Exhaustion	7.5 HIGH	CWE-770
3	Zip Bomb	7.5 HIGH	CWE-409
4	Missing Signature Validation	5.3 MEDIUM	CWE-345
5	TOCTOU Race Condition	3.1 LOW	CWE-367

Critical Finding: indexOf() Bypass

File: lib/decompress-zip.js:94

if (destination.indexOf(options.path) !== 0) {
    throw new Error('You cannot extract a file outside of the target path');
}

Bypass: ../extract_pwned/evil.txt passes the check because indexOf() does STRING prefix matching, not PATH containment.

PoC

Target: /project/extract
Malicious entry: ../extract_pwned/evil.txt
Result: File written to /project/extract_pwned/evil.txt (OUTSIDE target)

Reporter

Yahya Ganbarli

主要语言: 没有语言数据
星标: 2.5k
派生: 772
平均合并: 3 天 15 小时
30 天内合并 PR: 46