CVE-2020-12265
📋 TL;DR
CVE-2020-12265 is a directory traversal vulnerability in the decompress npm package for Node.js that allows attackers to write arbitrary files outside the intended extraction directory using path traversal sequences (../) in archive members. This affects any Node.js application using vulnerable versions of the decompress package to extract archives from untrusted sources. The vulnerability is particularly dangerous when combined with symlink manipulation.
💻 Affected Systems
- decompress npm package
📦 What is this software?
Decompress by Decompress Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file write leading to remote code execution, data destruction, or privilege escalation by overwriting critical system files.
Likely Case
Arbitrary file write to web directories leading to web shell deployment, data exfiltration, or denial of service by overwriting application files.
If Mitigated
Limited impact if only trusted archives are processed or proper input validation prevents malicious archive uploads.
🎯 Exploit Status
Exploitation is straightforward - create a malicious archive with path traversal sequences. Public proof-of-concept exists in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.1 and later
Vendor Advisory: https://www.npmjs.com/advisories/1217
Restart Required: No
Instructions:
1. Update package.json to specify decompress version 4.2.1 or higher. 2. Run 'npm update decompress' or 'npm install decompress@latest'. 3. Test archive extraction functionality.
🔧 Temporary Workarounds
Input validation and sanitization
allValidate and sanitize archive filenames before extraction to remove path traversal sequences
Implement custom filename sanitization: filename = filename.replace(/\.\.\//g, '')
Use alternative extraction library
allTemporarily switch to a different archive extraction library that is not vulnerable
npm uninstall decompress
npm install extract-zip
🧯 If You Can't Patch
- Implement strict input validation to reject archives containing path traversal sequences
- Run decompress operations in isolated containers or sandboxes with restricted file system access
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list decompress' to see installed version. If version is below 4.2.1, you are vulnerable.Check Version:
npm list decompress | grep decompressVerify Fix Applied:
After updating, verify with 'npm list decompress' that version is 4.2.1 or higher. Test extraction with a safe archive containing path traversal sequences.📡 Detection & Monitoring
Log Indicators:
- Unexpected file writes outside extraction directory
- Archive extraction errors with path traversal warnings
- Files appearing in unexpected locations after archive processing
Network Indicators:
- Large archive uploads followed by unusual file access patterns
- Archive uploads with suspicious filenames
SIEM Query:
source="application.logs" AND ("decompress" OR "extract") AND ("..\/" OR "path traversal" OR "directory traversal")