Description
The /scan endpoint extracts user-uploaded ZIP archives before scanning their contents. Currently, archive entries are extracted without validating their destination paths, making the endpoint vulnerable to Zip Slip attacks. A malicious archive containing paths such as ../ or absolute paths could write files outside the intended workspace, potentially overwriting sensitive files on the server.
To mitigate this, validate every archive entry before extraction and ensure it resolves within the scan's workspace directory.
Acceptance Criteria
Why This Matters
Zip Slip is a well-known archive extraction vulnerability that can allow attackers to write files outside the intended extraction directory. Validating extraction paths ensures uploaded archives cannot overwrite arbitrary files on the host system while still allowing legitimate scan requests to proceed.
Difficulty: Medium
Description
The
/scanendpoint extracts user-uploaded ZIP archives before scanning their contents. Currently, archive entries are extracted without validating their destination paths, making the endpoint vulnerable to Zip Slip attacks. A malicious archive containing paths such as../or absolute paths could write files outside the intended workspace, potentially overwriting sensitive files on the server.To mitigate this, validate every archive entry before extraction and ensure it resolves within the scan's workspace directory.
Acceptance Criteria
{ "error": "No safe files found in archive" }Why This Matters
Zip Slip is a well-known archive extraction vulnerability that can allow attackers to write files outside the intended extraction directory. Validating extraction paths ensures uploaded archives cannot overwrite arbitrary files on the host system while still allowing legitimate scan requests to proceed.
Difficulty: Medium