Rubyzip
Monthly
Path traversal in rubyzip before 3.4.0 allows an attacker who supplies a crafted ZIP archive to write files outside the intended extraction directory by exploiting a flawed prefix comparison in `Zip::Entry#extract`. The root cause is that the path guard checks `extract_path.start_with?(dest_dir)` without appending a trailing file separator, meaning a sibling directory sharing the destination string prefix - such as `out_evil` alongside destination `out` - passes validation and receives the extracted file. The fix is confirmed in v3.4.0; no active exploitation has been identified at time of analysis, but the attack primitive is straightforward to reproduce from the published commit diff.
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Path traversal in rubyzip before 3.4.0 allows an attacker who supplies a crafted ZIP archive to write files outside the intended extraction directory by exploiting a flawed prefix comparison in `Zip::Entry#extract`. The root cause is that the path guard checks `extract_path.start_with?(dest_dir)` without appending a trailing file separator, meaning a sibling directory sharing the destination string prefix - such as `out_evil` alongside destination `out` - passes validation and receives the extracted file. The fix is confirmed in v3.4.0; no active exploitation has been identified at time of analysis, but the attack primitive is straightforward to reproduce from the published commit diff.
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.