Skip to content

[atlas-update] Avoid Zip Slip Vulnerability#392

Open
ready-research wants to merge 1 commit into
alibaba:masterfrom
ready-research:ready-research-patch
Open

[atlas-update] Avoid Zip Slip Vulnerability#392
ready-research wants to merge 1 commit into
alibaba:masterfrom
ready-research:ready-research-patch

Conversation

@ready-research

Copy link
Copy Markdown

atlas is vulnerable to Zip Slip attacks using unzip. Reported in huntr.

ZipUtils.unzip("C:\evil.zip", "D:\test\test\test");      //input evil.zip contains ../../evil.exe which will be extracted in D:\test

@CLAassistant

CLAassistant commented Jan 27, 2022

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@ready-research ready-research changed the title Avoid Zip Slip Vulnerability [atlas-update] Avoid Zip Slip Vulnerability Jan 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants