New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[SECURITY] Fix Zip Slip Vulnerability #12
[SECURITY] Fix Zip Slip Vulnerability #12
Conversation
This fixes a Zip-Slip vulnerability. This change does one of two things. This change either 1. Inserts a guard to protect against Zip Slip. OR 2. Replaces `dir.getCanonicalPath().startsWith(parent.getCanonicalPath())`, which is vulnerable to partial path traversal attacks, with the more secure `dir.getCanonicalFile().toPath().startsWith(parent.getCanonicalFile().toPath())`. For number 2, consider `"/usr/outnot".startsWith("/usr/out")`. The check is bypassed although `/outnot` is not under the `/out` directory. It's important to understand that the terminating slash may be removed when using various `String` representations of the `File` object. For example, on Linux, `println(new File("/var"))` will print `/var`, but `println(new File("/var", "/")` will print `/var/`; however, `println(new File("/var", "/").getCanonicalPath())` will print `/var`. Weakness: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Severity: High CVSSS: 7.4 Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-zipslip/) & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.ZipSlip) Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> Bug-tracker: JLLeitschuh/security-research#16 Co-authored-by: Moderne <team@moderne.io>
Hi, agree that even if it is not exploitable by most env it is good to get it merged. Can you work on a test validating the PR fixes the issue before we integrate it please? |
Hi @rmannibucau, This pull request, along with 164 similar pull request, was automatically generated at-scale to fix this vulnerability across the OSS java ecosystem. Unfortunately, given the scale of this vulnerability, and the number of projects to be fixed, I don't have the time to craft such a unit test. In general, I 100% agree with you about needing a unit test to verify a change before merging, and I fully support someone stepping in to assist with creating such a test, but I unfortunately don't have the time to do so myself. I hope you can understand. 🙂 |
@JLLeitschuh would it help if I give you this test (
You just need to replace the unzip+asserttrue by a |
@rmannibucau I pushed your zip test example. I will merge this PR and update the test according to this PR. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@JLLeitschuh thanks for your contribution!
Friendly ping: @asfsecurity Does this need a CVE assigned to it? |
This is up to the Apache Geronimo team to decide. It is not clear to me whether the zip files processed here are assumed come from a trusted source or not: without intimate knowledge of the project, it seems this function would be used to unzip archives with the goal of executing its contents. If that's the case, anyone who can produce these archives can perform arbitrary code execution by design, and the 'zip slip' does not provide any elevated privileges. Of course it is still a valuable change from the perspective of hardening, best practices, and avoiding non-security bugs, but without further analysis I don't necessarily see the reason for a CVE here. Perhaps you or the Geronimo team has additional background that would clarify that need, of course. |
Theorically from anywhere but it should really come from a trusted source (same as webapps/ folder of tomcat if you are more familiar with it). There is also a pending thread to know if we keep the project or move it to something like "geronimo-"attic so can also change the downstream process, not sure when it will be decided since it lagged due to holidays but we should re-up it to ensure we don't work for nothing too. |
If the zip archive could come from anywhere, then it would be appropriate to issue a CVE here. Is there a discussion inside the ASF about this, or does one need to be kicked off? |
Well there is no discussion yet - and to be honest "anywhere" does not mean "downloaded from a random source" but literally "put by an user there". So BatchEE does not take into account the zip creation of the zip it extracts but it must be put intentionally by end user there so if it is insecure the user intentionally put an insecure zip, similarly to put an attacker code voluntary in tomcat webapps folder. This is why I'm not sure it needs a CVE, we can create one in low level but not sure it would serve much end users. |
That's indeed how I understood your previous comment. Based on this it doesn't look like the zip slip provides any additional privileges to an attacker (as an attacker that can control the zip already has full control, right?). If that's indeed the case I don't see a reason to issue a CVE. |
Sounds good, thank you all for the thorough assessment of the situation. I really appreciate it! |
Security Vulnerability Fix
This pull request fixes a Zip Slip vulnerability either due to an insufficient, or missing guard when unzipping zip files.
Even if you deem, as the maintainer of this project, this is not necessarily fixing a security vulnerability, it is still, most likely, a valid security hardening.
Preamble
Impact
This issue allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system.
Overwriting certain files/directories could allow an attacker to achieve remote code execution on a target system by exploiting this vulnerability.
Why?
The best description of Zip-Slip can be found in the white paper published by Snyk: Zip Slip Vulnerability
But I had a guard in place, why wasn't it sufficient?
If the changes you see are a change to the guard, not the addition of a new guard, this is probably because this code contains a Zip-Slip vulnerability due to a partial path traversal vulnerability.
To demonstrate this vulnerability, consider
"/usr/outnot".startsWith("/usr/out")
.The check is bypassed although
/outnot
is not under the/out
directory.It's important to understand that the terminating slash may be removed when using various
String
representations of theFile
object.For example, on Linux,
println(new File("/var"))
will print/var
, butprintln(new File("/var", "/")
will print/var/
;however,
println(new File("/var", "/").getCanonicalPath())
will print/var
.The Fix
Implementing a guard comparing paths with the method
java.nio.files.Path#startsWith
will adequately protect against this vulnerability.For example:
file.getCanonicalFile().toPath().startsWith(BASE_DIRECTORY)
orfile.getCanonicalFile().toPath().startsWith(BASE_DIRECTORY_FILE.getCanonicalFile().toPath())
Other Examples
➡️ Vulnerability Disclosure ⬅️
👋 Vulnerability disclosure is a super important part of the vulnerability handling process and should not be skipped! This may be completely new to you, and that's okay, I'm here to assist!
First question, do we need to perform vulnerability disclosure? It depends!
For partial path traversal, consider if user-supplied input could ever flow to this logic. If user-supplied input could reach this conditional, it's insufficient and, as such, most likely a vulnerability.
Vulnerability Disclosure How-To
You have a few options options to perform vulnerability disclosure. However, I'd like to suggest the following 2 options:
JLLeitschuh Disclosure
in the subject of your email so it is not missed.Detecting this and Future Vulnerabilities
You can automatically detect future vulnerabilities like this by enabling the free (for open-source) GitHub Action.
I'm not an employee of GitHub, I'm simply an open-source security researcher.
Source
This contribution was automatically generated with an OpenRewrite refactoring recipe, which was lovingly handcrafted to bring this security fix to your repository.
The source code that generated this PR can be found here:
Zip Slip
Why didn't you disclose privately (ie. coordinated disclosure)?
This PR was automatically generated, in-bulk, and sent to this project as well as many others, all at the same time.
This is technically what is called a "Full Disclosure" in vulnerability disclosure, and I agree it's less than ideal. If GitHub offered a way to create private pull requests to submit pull requests, I'd leverage it, but that infrastructure, sadly, doesn't exist yet.
The problem is that, as an open source software security researcher, I (exactly like open source maintainers), I only have so much time in a day. I'm able to find vulnerabilities impacting hundreds, or sometimes thousands of open source projects with tools like GitHub Code Search and CodeQL. The problem is that my knowledge of vulnerabilities doesn't scale very well.
Individualized vulnerability disclosure takes time and care. It's a long and tedious process, and I have a significant amount of experience with it (I have over 50 CVEs to my name). Even tracking down the reporting channel (email, Jira, etc..) can take time and isn't automatable. Unfortunately, when facing problems of this scale, individual reporting doesn't work well either.
Additionally, if I just spam out emails or issues, I'll just overwhelm already over-taxed maintainers, I don't want to do this either.
By creating a pull request, I am aiming to provide maintainers something highly actionable to actually fix the identified vulnerability; a pull request.
There's a larger discussion on this topic that can be found here: JLLeitschuh/security-research#12
Opting Out
If you'd like to opt out of future automated security vulnerability fixes like this, please consider adding a file called
.github/GH-ROBOTS.txt
to your repository with the line:This bot will respect the ROBOTS.txt format for future contributions.
Alternatively, if this project is no longer actively maintained, consider archiving the repository.
CLA Requirements
This section is only relevant if your project requires contributors to sign a Contributor License Agreement (CLA) for external contributions.
It is unlikely that I'll be able to directly sign CLAs. However, all contributed commits are already automatically signed off.
If signing your organization's CLA is a strict-requirement for merging this contribution, please feel free to close this PR.
Sponsorship & Support
This contribution is sponsored by HUMAN Security Inc. and the new Dan Kaminsky Fellowship, a fellowship created to celebrate Dan's memory and legacy by funding open-source work that makes the world a better (and more secure) place.
This PR was generated by Moderne, a free-for-open source SaaS offering that uses format-preserving AST transformations to fix bugs, standardize code style, apply best practices, migrate library versions, and fix common security vulnerabilities at scale.
Tracking
All PR's generated as part of this fix are tracked here: JLLeitschuh/security-research#16