CVE-2019-10743 (Zip Slip Attack)

[gnuletik]

Naabu is using github.com/mholt/archiver@v3.1.1 which is vulnerable to a Zip Slip Attack.

naabu/v2/go.mod

Line 60 in ca4456c

github.com/mholt/archiver v3.1.1+incompatible // indirect

https://nvd.nist.gov/vuln/detail/CVE-2019-10743
mholt/archiver#169

Please update to https://github.com/mholt/archiver/releases/tag/v3.3.2 to fix the issue.

Security Policy

NB: I tried reporting the vulnerability to security[@]projectdiscovery.com as required by the https://github.com/projectdiscovery/naabu/security/policy but the address does not exist anymore (550 No Such User Here).

[ehsandeep]

Thank you @gnuletik for the issue, I will check what went wrong with the email.

[ehsandeep]

I'm not sure about any security impact here, but we should update the dep.

[toufik-airane]

Dear @gnuletik,

I wanted to thank you for submitting your report.

Unfortunately for us, it appears that a typo was inadvertently included in the security.md. The correct email address to use is security@projectdiscovery.io.

Thank you for bringing this matter to our attention.

[toufik-airane]

Additionally, with regards to the report's content, we presently categorize third-party concerns as being out-of-scope if there is no supporting evidence of vulnerability (such as a proof of concept) that demonstrates a tangible security impact on the target.

If you are able to provide a proof of concept demonstrating a concrete security impact on the target, we would be pleased to consider the report for inclusion in an eligible crowdsourced security program.

Meanwhile, I'm inclined to close the issue as informative. @RamanaReddy0M

We appreciate you notifying us about this matter, thank you.

[Mzack9999]

@gnuletik Thanks for notifying this potential vulnerability. After review, it seems like the automatic dependencies update is already covered via dependantbot, but we were missing an automatic library release with updated versions (added in projectdiscovery/gologger#41). Although not directly exploitable, all vulnerabilities must be mitigated and addressed. Hence thanks again for your help. I'm closing the issue as completed.