CVE-2024-48510
📋 TL;DR
This CVE describes a directory traversal vulnerability in DotNetZip v1.16.0 and earlier that allows remote attackers to write arbitrary files outside the intended extraction directory. Attackers can exploit this to achieve remote code execution by writing malicious files to sensitive locations. Only products using unsupported versions of DotNetZip are affected.
💻 Affected Systems
- DotNetZip
📦 What is this software?
Dotnetzip.semverd by Dotnetzip.semverd Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/root privileges leading to complete system compromise, data exfiltration, and lateral movement.
Likely Case
Arbitrary file write leading to web shell deployment, data manipulation, or privilege escalation.
If Mitigated
File write limited to intended directory with proper input validation and file permission restrictions.
🎯 Exploit Status
The vulnerability is in the Extract.cs component where path validation is insufficient. Attackers can craft ZIP archives with directory traversal sequences (../) in filenames.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
1. Migrate to a maintained alternative like System.IO.Compression.ZipArchive (built into .NET) or SharpZipLib. 2. Remove DotNetZip from your projects. 3. Update all dependencies to use secure alternatives.
🔧 Temporary Workarounds
Implement custom extraction validation
allAdd path validation before extraction to ensure files stay within intended directory
Implement code to validate extracted paths against allowed directory using Path.GetFullPath() and checking for directory traversal sequences
Use alternative ZIP library
allReplace DotNetZip with System.IO.Compression.ZipArchive or other maintained libraries
Install-Package System.IO.Compression.ZipFile
Remove-Package DotNetZip
🧯 If You Can't Patch
- Implement strict input validation on ZIP file uploads and reject files with suspicious path patterns
- Run applications using DotNetZip with minimal privileges and in isolated environments
🔍 How to Verify
Check if Vulnerable:
Check project dependencies for DotNetZip version 1.16.0 or earlier. Review code for usage of ZipEntry.Extract methods.Check Version:
Check .csproj or packages.config for <PackageReference Include="DotNetZip" Version="..." />Verify Fix Applied:
Verify DotNetZip is removed from dependencies and replaced with secure alternatives. Test extraction with malicious ZIP files containing traversal sequences.📡 Detection & Monitoring
Log Indicators:
- Failed file write attempts outside expected directories
- Unusual process creation from ZIP extraction processes
- Multiple ../ sequences in file paths in application logs
Network Indicators:
- Large ZIP file uploads followed by suspicious outbound connections
- Unusual file writes to system directories
SIEM Query:
source="application_logs" AND ("../" OR "..\\" OR "%2e%2e%2f") AND "extract" AND "zip"🔗 References
- https://gist.github.com/thomas-chauchefoin-bentley-systems/855218959116f870f08857cce2aec731
- https://github.com/haf/DotNetZip.Semverd
- https://github.com/haf/DotNetZip.Semverd/blob/e487179b33a9a0f2631eed5fb04d2c952ea5377a/src/Zip.Shared/ZipEntry.Extract.cs#L1365-L1410
- https://www.nuget.org/packages/DotNetZip/
