GHSA-73v8-v6g4-vrpm Arbitrary File Overwrite in decompress-zip
Attackers can overwrite arbitrary files via Zip-Slip in decompress-zip, requiring an upgrade to secure the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-73v8-v6g4-vrpm?
GHSA-73v8-v6g4-vrpm is a path traversal vulnerability in decompress-zip, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory.
Recommendation
For decompress-zip 0.2.x upgrade to 0.2.2 or later.
For decompress-zip 0.3.x upgrade to 0.3.2 or later.
Which versions are affected by GHSA-73v8-v6g4-vrpm?
4 open source packages ship an affected version, including decompress-zip.
| Package | Affected | Fixed in |
|---|---|---|
decompress-zip npm | All versions | 0.2.2 |
decompress-zip npm | All versions | 0.2.2 |
decompress-zip npm | From 0.3.0 | 0.3.2 |
decompress-zip npm | From 0.3.0 | 0.3.2 |
How do I fix GHSA-73v8-v6g4-vrpm?
Upgrade decompress-zip to a fixed version for your release line: 0.2.2 or 0.3.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-73v8-v6g4-vrpm being exploited?
There is no known exploitation of GHSA-73v8-v6g4-vrpm in the wild and no public exploit code.