zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 9.0.5
- Public exploit
- None on Exploit-DB
Summary
The zip library for Rust, used to read and write ZIP archives, is affected. A specially crafted archive can make a streaming extractor write files to an attacker-chosen path with attacker-chosen content, which can overwrite files used by other services and potentially allow arbitrary code execution, while security checks that read the archive's central directory see only harmless contents.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
Affected versions
- zip-rs zip2
fixed in 9.0.5