Erlang/OTP zip Relative Path Traversal Vulnerability (CVE-2024-47078) Advisory and Fix

Vulnerability Overview Vulnerability Name: Relative path traversal in via depth-counter bypass Vulnerability Description: and contain a relative path traversal vulnerability. An attacker can craft a ZIP archive containing special entry names (e.g., ) to cause files to be written outside the intended extraction directory. Vulnerability Details: The function validates ZIP entry paths by tracking directory depth, but this check is insufficient. Attackers can bypass path validation by constructing specific paths (e.g., ), ultimately resolving to a directory level above the target. Affected Versions Affected Versions: - OTP: >= 27.1 - stdlib (OTP): >= 6.1 Remediation Fixed Versions: - OTP: 27.3.4.15, 28.5.0.4, 29.0.4 - stdlib (OTP): 6.2.2.4, 7.3.0.1, 8.0.3 POC Code Additional Information CVSS v4 Base Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Attack Requirements: None - Privileges Required: None - User Interaction: Passive - Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: Low - Availability: Low - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: Low - Availability: Low CVE ID: CVE-2024-47078 Weakness: CWE-22 Contributors: - manchen (Reporter) - jloberg (Fix Developer) - zhangdelong429-hash (Reporter) Summary This vulnerability allows attackers to bypass path validation by constructing specific ZIP archives, causing files to be written outside the intended extraction directory. This may lead to severe consequences such as Remote Code Execution (RCE), configuration tampering, or data corruption. It is recommended to upgrade to the fixed versions as soon as possible to resolve this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Erlang/OTP zip Relative Path Traversal Vulnerability (CVE-2024-47078) Advisory and Fix

More from this source