Skip to content

Vulnerability in handling of uploaded QTI ZIP files

High
davemckain published GHSA-xrjg-59rc-4j42 Oct 28, 2022

Package

maven qtiworks-engine (Maven)

Affected versions

< 1.0-beta14

Patched versions

1.0-beta15

Description

Impact

The QTIWorks Engine allows users to upload QTI content packages as ZIP files.

The current ZIP handling code does not sufficiently check the paths of files contained within ZIP files, so can insert files into other locations in the filesystem if they are writable by the process running the QTIWorks Engine.

In extreme cases, this could allow anonymous users to change files in arbitrary locations in the filesystem. This is therefore a critical flaw.

In normal QTIWorks Engine deployments, the impact is somewhat reduced because the default QTIWorks configuration does not enable the public demo functionality, so ZIP files can only be uploaded by users with "instructor" privileges.

Patches

This vulnerability is fixed in version 1.0-beta15.

All users of the QTIWorks Engine should upgrade to this version.

(In general, we'd recommend that users who run their own QTIWorks Engine deployment should only allow their servlet container to write to specific filesystem locations. This reduces the impact of vulnerabilities like this.)

Workarounds

There are no workarounds. Users should upgrade to 1.0-beta15. There are no database configuration changed required when upgrading to this version.

References

Details about these Zip Slip vulnerabilities can be found in:
https://security.snyk.io/research/zip-slip-vulnerability

Many thanks to @JLLeitschuh for reporting this vulnerability.

For more information

Please open an issue to discuss this vulnerability:
https://github.com/davemckain/qtiworks/issues

Severity

High
8.6
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CVE ID

CVE-2022-39367

Weaknesses

No CWEs

Credits