Arbitrary File Write via Archive Extraction (Zip Slip) Affecting system.io.compression.zipfile package, versions [,4.3.0)


0.0
medium
  • Attack Complexity

    Low

  • Integrity

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-DOTNET-SYSTEMIOCOMPRESSIONZIPFILE-174570

  • published

    2 May 2019

  • disclosed

    12 Sep 2018

  • credit

    Unknown

How to fix?

Upgrade System.IO.Compression.ZipFile to version 4.3.0 or higher.

Overview

System.IO.Compression.ZipFile provides classes that support the compression and decompression of streams using file system paths.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). An attacker could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, they must send a specially crafted file to a vulnerable system.