Snyk Security Database

extract-zip is an unzip a zip file into a directory using 100% javascript

Affected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in index.js. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running extract-zip.

databricks-webapp-navigation-homepage is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

org.apache.ant:ant is a software tool for automating software build processes which originated from the Apache Tomcat project in early 2000.

Affected versions of this package are vulnerable to Relative Path Traversal through the file retrieval logic in FTPTask, FTPTaskMirrorImpl, ScpFromMessage, and ScpFromMessageBySftp. An attacker controlling the remote server, or a man-in-the-middle for non-FTPS FTP, can supply filenames or directory entries with relative path components that make Ant write outside the intended destination directory, allowing arbitrary file overwrite with the privileges of the user running Ant.

Workarounds

• Do not bypass server identity checks when using scp or ftp with ftps; only download from servers whose identity you verify, to reduce the chance of a malicious or man-in-the-middle server supplying path-traversal filenames.
• For ftp transfers that are not using ftps, switch to ftps where possible, to prevent a man-in-the-middle from tampering with the server’s file names or directory entries during download.