MediumGHSA-3v6h-hqm4-2rg6CVE-2018-1002204

Arbitrary File Write in adm-zip

Published 27 Jul 2018 · Updated 8 Nov 2023

Affected package

Affected: <0.4.11
Fixed in: 0.4.11

Update to the fixed version for your release line, for example:npm install adm-zip@0.4.11

Details

Versions of adm-zip before 0.4.9 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames (../../file.txt for example).

Recommendation

Update to version 0.4.9 or later.

Is GHSA-3v6h-hqm4-2rg6 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected adm-zip, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2018-1002204
Linkgithub.com/cthackers/adm-zip/pull/212
Linkgithub.com/cthackers/adm-zip/commit/62f64004fefb894c523a7143e8a88ebe6c84df25
Linkhackerone.com/reports/362118
Advisorygithub.com/advisories/GHSA-3v6h-hqm4-2rg6
Linkgithub.com/snyk/zip-slip-vulnerability
Linksnyk.io/research/zip-slip-vulnerability
Linksnyk.io/vuln/npm:adm-zip:20180415
Linkwww.npmjs.com/advisories/681
Linkwww.npmjs.com/advisories/994
Linkwww.securityfocus.com/bid/107001

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.