CVE-2018-1263 spring-integration-zip Arbitrary File Write
Attackers can write arbitrary files outside the target directory using crafted archives, impacting applications using the Spring Integration Zip library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1263?
CVE-2018-1263 is a medium-severity path traversal vulnerability in Pivotal Spring Integration Zip, published on 15 May 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Weakness: CWE-22
Which versions are affected by CVE-2018-1263?
2 open source packages ship an affected version, including org.springframework.integration:spring-integration-zip. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.integration:spring-integration-zip Maven | All versions | 1.0.2 |
org.springframework.integration:spring-integration-zip Maven | All versions | 1.0.2 |
Products include Vmware Spring Integration Zip.
How do I fix CVE-2018-1263?
Upgrade org.springframework.integration:spring-integration-zip to 1.0.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-1263 being exploited?
There is no known exploitation of CVE-2018-1263 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Pivotal Spring Integration Zip
Sources
Also known as GHSA-87vg-5pgx-pggh.