Archive and document parsers
Archive and document parsers turn entry names and links into filesystem paths. An entry that resolves outside the extract root is the primitive. Impact starts when the service later reads or writes that path, on a file you created.
Tags: parser, archive, upload
Level: advanced
Method
Find the parser
Upload, import, preview, and unzip-in-place are the usual features. Note the format the product claims to accept.
Tools: browser
Use an archive you built
The proof starts from a file you created for an account you own. Do not upload it anywhere the program did not list.
Tools: browser
Watch where the entry lands
The interesting result is a path outside the extract directory, observed in an error, a preview, or a later download of a file you are allowed to see.
Tools: Burp Suite
Links inside documents
Office files and PDFs can point at external URLs. If the server fetches them, that is a fetch bug and belongs with SSRF evidence, not as a path bug.
Tools: Burp Suite
Fail-open on a bad entry
A parser that errors and still keeps a partial extract can expose or write a path it should have rejected. That is also an A10-shaped note.
Tools: Burp Suite
Do not aim at paths you do not own
Impact is a file the service reads or writes inside the test account. Stop there.
Tools: browser
Field notes
- XXE is a different hunt. This page is path and archive handling.
- A filename in an error message is a signal. It is not yet impact.
- Symlinks and nested archives are the same question: where does the name resolve.