Directory traversal (dubbed ZipSlip) vulnerability discovered in DeepLearning4j (ArchiveUtils)…
Directory traversal (dubbed ZipSlip) vulnerability discovered in DeepLearning4j (ArchiveUtils) library
Recently, we’ve identified a number of our customers who are susceptible to a Directory traversal vulnerability. The exploit chain (circumstances to exploit the vulnerability) is being triggered by customer application’s dependency on a DeepLearning4j ArchiveUtils utility. This vulnerability is particularly tricky to catch, because it is contextual: The exposure comes from how impacted library interacts with API request controllers in web applications.
Java provides the java.util.zip package for zip-compatible data compression. It provides classes that enable you to read, create, and modify ZIP and GZIP file formats.
A number of security concerns must be considered when extracting file entries from a ZIP file using java.util.zip.ZipInputStream.
Exploit type #1 : Directory Traversal
File names may contain path traversal information that may cause them to be extracted outside of the intended directory, frequently with the purpose of overwriting existing system files. Directory traversal or path equivalence vulnerabilities can be eliminated by canonicalizing the path name and then validating the location before extraction.
Exploit type #2 : Denial of Service
A second issue is that the extraction process can cause excessive consumption of system resources, possibly resulting in a denial-of-service attack when resource usage is disproportionately large compared to the input data. The zip algorithm can produce very large compression ratios. Even higher compression ratios can be obtained using input data that is targeted to the compression algorithm. This permits the existence of zip bombs in which a small ZIP or GZIP file consumes excessive resources when uncompressed.
Zip Slip Vulnerability
Snyk recently discovered and disclosed that several thousand projects were impacted by this type #1 (Directory traversal) vulnerability dubbed as ZipSlip.
Application Flow
This typically involves injecting file path meta-characters into a filename string inside the compressed archive to reference or upload malicious scripts resulting in compromising the host resource.
Almost all of the high-level application APIs provide a means, or a third-party library, to handle archive files. Additionally, almost all of these libraries do not check for potential directory path traversal when they perform the extraction of these files. This puts the liability on the developer to check for malicious archives. While file operation calls with a user controlled variable may be obvious, filenames within user-controlled archives may be the vulnerability that slips by.
Detection and Mitigation
Developers should not only validate user supplied file paths for directory traversal, but also check file paths included in archive files.
Although this condition is pervasive across several open source libraries, this exploit can be only triggered if an exposed public API accepts an exploitive archive payload (which can potentially become an attack vector) and uses the vulnerable library’s unzip utility to extract it’s contents without conducting validation.
Using ShiftLeft’s state of art Data Flow Tracker + High Level Information Flow combined with active runtime protection, we were able to detect and protect from this exploit being triggered.
Adam Gibson, CTO/Co-Founder of SkyMind.ai / co-author of DeepLearning4j was kind enough to quickly jump to accept our patch.
Please immediately update to latest version of DeepLearning4j.
We have also updated Snyk’s current list of impacted libraries as well.
Conclusion
When writing code that interacts with archives, the same precautions used by mainstream extraction utilities must be performed by the developers and open source library authors. As with any attacker-controlled/user-controlled input, the directory filenames should be validated before being processed by any file operation. The developer should verify that path traversal characters do not occur in any entries within the archive.
Directory traversal (dubbed ZipSlip) vulnerability discovered in DeepLearning4j (ArchiveUtils)… was originally published in ShiftLeft Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
*** This is a Security Bloggers Network syndicated blog from ShiftLeft Blog - Medium authored by Chetan Conikee. Read the original post at: https://blog.shiftleft.io/directory-traversal-dubbed-zipslip-vulnerability-discovered-in-deeplearning4j-archiveutils-603162e0fbca?source=rss----86a4f941c7da---4
