CVE-2023-39137
📋 TL;DR
This vulnerability in Archive v3.3.7 allows attackers to spoof ZIP filenames, leading to inconsistent filename parsing. This can enable attackers to hide malicious files with legitimate-looking names, potentially bypassing security checks. Any system using the vulnerable Archive library to process ZIP files is affected.
💻 Affected Systems
- Archive library
📦 What is this software?
Archive by Archive Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could deliver malware disguised as legitimate files, leading to system compromise, data theft, or ransomware deployment when users extract the malicious ZIP archives.
Likely Case
Attackers could bypass security scanners and user scrutiny by making malicious files appear as harmless documents or system files, increasing successful phishing or malware delivery rates.
If Mitigated
With proper file validation, sandboxing, and user education, the risk reduces to occasional bypass of initial security checks, but secondary defenses should catch malicious payloads.
🎯 Exploit Status
Exploitation requires user interaction to extract a malicious ZIP file, but the filename spoofing technique is well-documented and similar to known WinRAR exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.3.8 or later
Vendor Advisory: https://github.com/brendan-duncan/archive/issues/266
Restart Required: No
Instructions:
1. Update Archive library to v3.3.8 or later. 2. Rebuild/redeploy any applications using the library. 3. Test ZIP file processing functionality.
🔧 Temporary Workarounds
Implement file validation
allAdd additional validation checks for extracted filenames before processing
Use alternative ZIP library
allTemporarily switch to a different ZIP processing library until patched
🧯 If You Can't Patch
- Implement strict file extension validation for all extracted files
- Educate users to be cautious with ZIP files from untrusted sources and verify file contents before opening
🔍 How to Verify
Check if Vulnerable:
Check if your application uses Archive library v3.3.7 in dependencies or package manifestCheck Version:
Check package.json, pubspec.yaml, or equivalent dependency file for 'archive: ^3.3.7'Verify Fix Applied:
Verify Archive library version is v3.3.8 or later and test with known malicious ZIP samples📡 Detection & Monitoring
Log Indicators:
- Multiple failed file extraction attempts
- Files with mismatched extensions/content types
- Security scanner alerts about suspicious ZIP structures
Network Indicators:
- Unusual ZIP file downloads from external sources
- Multiple users downloading similar ZIP files
SIEM Query:
source="security_scanner" AND ("ZIP spoofing" OR "filename inconsistency" OR "archive parsing error")🔗 References
- https://blog.ostorlab.co/zip-packages-exploitation.html
- https://github.com/brendan-duncan/archive/issues/266
- https://ostorlab.co/vulndb/advisory/OVE-2023-3
- https://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_name_spoofing/
- https://blog.ostorlab.co/zip-packages-exploitation.html
- https://github.com/brendan-duncan/archive/issues/266
- https://ostorlab.co/vulndb/advisory/OVE-2023-3
- https://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_name_spoofing/
