Zip Slip via unvalidated archive entry extraction path
ID |
vbnet.path_resolution.zip_slip |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Path Resolution |
Language |
VB.NET |
Description
A Zip archive entry name flows into a filesystem write path without neutralization. A crafted entry such as "../../evil.exe" escapes the extraction directory (Zip Slip), potentially overwriting executables or configuration files. Strip directory components with Path.GetFileName and confirm the resolved path stays under an allow-listed extraction root.
Rationale
A Zip archive entry name flows into a filesystem write path without neutralization. A crafted entry such as "../../evil.exe" escapes the extraction directory (Zip Slip), potentially overwriting executables or configuration files. Strip directory components with Path.GetFileName and confirm the resolved path stays under an allow-listed extraction root.
The following code illustrates a vulnerable pattern detected by this rule:
Public Sub ExtractCombineFullName(ByRef archive As ZipArchive, destDir As String)
For Each entry As ZipArchiveEntry In archive.Entries
' VULNERABLE: Zip Slip via unvalidated archive entry extraction path
Dim fullPath = Path.Combine(destDir, entry.FullName)
Next
End SubRemediation
Follow secure coding practices and review the references below for detailed remediation guidance.