33
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Zip Slip : "Zip slip" is an attack that uses file archives (e.g., ZIP, tar, rar, etc.) that contain filenames
with path traversal sequences that cause the files to be written outside of the directory under which
the archive is expected to be extracted [REF-1282]. It is most commonly used for relative path
traversal (CWE-23) and link following (CWE-59).
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical
files that are used to execute code, such as programs or
libraries.
Integrity Modify Files or Directories
The attacker may be able to overwrite or create critical
files, such as programs, libraries, or important data. If
the targeted file is used for a security mechanism, then
the attacker may be able to bypass that mechanism.
For example, appending a new account at the end
of a password file may allow an attacker to bypass
authentication.
Confidentiality Read Files or Directories
The attacker may be able read the contents of unexpected
files and expose sensitive data. If the targeted file is used
for a security mechanism, then the attacker may be able
to bypass that mechanism. For example, by reading a
password file, the attacker could conduct brute force
password guessing attacks in order to break into an
account on the system.
Availability DoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt
unexpected critical files such as programs, libraries, or
important data. This may prevent the product from working
at all and in the case of a protection mechanisms such as
authentication, it has the potential to lockout every user of
the product.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
CWE Version 4.14
CWE-23: Relative Path Traversal
CWE-23: Relative Path Traversal