Archive entry escapes the extract root
Zip, tar, package, theme, and office bundles are parsers that turn entry names and links into filesystem paths. The gadget is an entry whose name is absolute, climbs out of the extract root, or is a link that points outside that root, combined with an…
Tags: parser, archive, upload, path
Typical severity: P3-P4
What it becomes
Low alone when the product only lists entry names, and it becomes a file overwrite or a later read when an entry resolves outside the extract root.
Where to look
zip and tar importoffice, theme, and course bundlespackage uploads that extract before they scan
Chains
- File overwrite: An archive you created contains an entry that resolves outside the extract root, and the service writes it on a path it later reads.
- Link follow: A link entry points outside the root and the extractor or a later read follows it.
Notes
- Use an archive you built and an account you own. Do not aim the extractor at files you do not own, and do not include malware.
- Showing a name that would escape is the primitive. Impact is a path the service actually wrote or read inside the scope you were given.