According to recent reports, a number of vulnerabilities have been discovered in widely used ZIP libraries of Swift and Flutter.
These packages are being utilized by numerous developers and applications, which significantly increases the potential attack surface.
Developers use ZIP packages to create a bundle of libraries, components, resources, and other app files used for the application’s functionality. A malicious ZIP package can severely impact the application and compromise its security.
Structure of a ZIP file
A ZIP file has four major parts that construct its structure. These parts have different functions, from the ZIP archive’s file name to the central directory’s access. The parts are,
Local File Header – Contains essential information such as the file’s name, compression method, size, and other attributes.
Data Descriptor – Stores CRC 32 (Cyclic redundancy check 32) checksum of the uncompressed data, the compressed and uncompressed data.
Central Directory File Header – Contains metadata of each file within the archive.
End of Central Directory Record (EOCD) – This is the section at the end of a ZIP file, which also marks the end of the central directory.
ZIP file Vulnerability types & CVE(s)
ZIP files have four most common types of vulnerabilities,
ZIP Path Traversal – When the application has insufficient validation of zip entries’ file names.
ZIP file name spoofing – If the parser reads only the Local file header and proceeds to extract the file in the Central Directory Entry.
ZIP symlink path traversal – ZIP symlinks point to files outside the extraction directory, which could lead to overwriting sensitive data or code execution.
ZIP Bomb – a ZIP file contains enormous amounts of compressed data, which can cause Denial-of-Service (DoS) when extracted.
The archive package parses only the filename from the Local File header, leading to an inconsistency. Threat actors can use this vulnerability to craft a malicious ZIP file that has different filenames in the Local File header and Central Directory Entry.
It was also found that this package also links symlinks back after extraction. In addition to that, the links can also point to any path outside of the directory.
ZIPfoundation package passes the path from the zip entry directory to the fileManager.createSymbolicLink without proper check, leading to symlink pointing outside the extraction directory.
The zip package uses the unzipfile function to extract zip files. However, the pathString from the zip entry is directly sent to the destination without proper sanitization, which can be abused and perform a path traversal.
ZIPArchive has implemented proper sanitization for checking filenames by prepending them with file:\\\ prefix to the zip entry path. However, this can be bypassed if the filenames are presented with /.. Prefix resulting in the sanitization becoming file:\\ with 7 characters, which normally requires 8. This leads to a Denial-of-Service (DoS) attack on the application.
The Summary of the vulnerabilities discovered depending on their package is given below.
Package
Language
ZIP Filename Spoofing
ZIP Symlink
ZIP Path Traversal
Denial of Service
Archive
Dart (Flutter)
Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Flutter_archive
Dart (Flutter)
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
ZIPFoundation
Swift
Not Vulnerable
Vulnerable
Vulnerable
Not Vulnerable
ZIP
Swift
Not Vulnerable
Not Vulnerable
Vulnerable
Not Vulnerable
ZIPArchive
Swift
Not Vulnerable
Not Vulnerable
Not Vulnerable
Vulnerable
These vulnerabilities were reported to the concerned authors, and developers are recommended to stay up-to-date about the security updates to prevent malicious actors.
