ZIP Archive Directory Traversal

The "Zip Slip" vulnerability demonstrates how trusting the internal structure of an archive can lead to remote code execution.

The Vulnerability

A ZIP archive contains a central directory that lists the files inside, along with their names and paths. When extraction software processes the archive, it creates files on disk based on these names.

If an attacker crafts a ZIP file containing entries with directory traversal characters (e.g., ../../../../etc/passwd or ../../../../windows/system32/evil.dll), vulnerable extraction software will blindly write the file to the absolute path on the target system, escaping the intended destination folder.

Impact

By overwriting critical system files or placing an executable in a startup directory, the attacker achieves persistence and code execution.

Detection & Mitigation

Forensic analysts inspect ZIP archives for suspicious path separators. Extraction libraries must implement strict path validation, ensuring that the resolved path of an extracted file remains within the boundaries of the target directory.