疑似Oday
A scanner and testter of the CVE-2025-11001 of 7-zip# 🔒 Se7enSlip - 7-Zip Vulnerability Scanner
A stunning, interactive web application that demonstrates and helps detect the critical CVE-2023-52169 symlink traversal vulnerability in 7-Zip archives.
## ⚡ Features
### 🎯 Core Functionality
- **ZIP Upload & Analysis** - Drag & drop or click to upload ZIP files for comprehensive security analysis
- **Real-time Scanning** - Advanced pattern detection for path traversal, symlinks, and malicious entries
- **Detailed Reports** - Executive-level reporting with risk assessment and recommendations
- **Interactive Demo** - Animated vulnerability explanation showing attack flow
### 🎨 Premium UI/UX
- **Matrix Rain Effect** - Animated background with falling digital characters
- **Floating Particles** - Dynamic particle system for enhanced visual appeal
- **Smooth Animations** - Entrance animations, hover effects, and transitions throughout
- **Dark Theme** - Modern, hackery aesthetic with neon green accents
- **Responsive Design** - Fully optimized for desktop, tablet, and mobile devices
### 🔐 Security Features
- **Rate Limiting** - Protection against abuse with request throttling
- **File Validation** - Strict ZIP file type and size validation (50MB limit)
- **Secure Headers** - Helmet.js integration for security headers
- **Input Sanitization** - XSS protection and safe HTML rendering
### 📊 Advanced Analysis
- **Pattern Recognition** - Detects multiple vulnerability patterns:
- Path traversal sequences (`../`, `..\\`)
- Absolute paths (`/`, `C:\\`)
- Symlink entries
- Executable files
- Null byte injection
- Excessive path lengths
- **Risk Assessment** - Automatic risk level calculation (Safe, Medium, High, Critical)
- **Metadata Extraction** - File counts, sizes, compression ratios, path depths
## 🚀 Quick Start
### Prerequisites
- Node.js 14+
- npm or yarn
### Installation
1. **Clone the repository**
```bash
git clone <repository-url>
cd Se7enSlip
```
2. **Install dependencies**
```bash
npm install
```
3. **Start the development server**
```bash
npm start
```
4. **Open your browser**
Navigate to `http://localhost:3000`
### Alternative Commands
```bash
# Development with auto-reload
npm run dev
# Create a test vulnerable ZIP file
npm run create-test-zip
# Production build
npm run build
```
## 📋 CVE-2023-52169 Details
### Vulnerability Overview
- **CVE ID**: CVE-2023-52169
- **CVSS Score**: 7.8 (High Severity)
- **Affected Software**: 7-Zip versions < 23.01
- **Attack Vector**: Local file processing
- **Impact**: Arbitrary file write, potential code execution
### Technical Details
The vulnerability allows attackers to craft malicious ZIP archives that, when extracted by vulnerable 7-Zip versions, can write files outside the intended extraction directory. This is achieved through:
1. **Symlink Traversal** - Creating symbolic links that point outside extraction directory
2. **Path Traversal** - Using `../` sequences to escape extraction folder
3. **Absolute Paths** - Specifying complete file system paths
### Exploitation Flow
```
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Malicious ZIP │───▶│ Vulnerable 7-Zip│───▶│ System Compromise│
│ │ │ < v23.01 │ │ │
│ • ../../../etc/ │ │ │ │ • File overwrite│
│ • /tmp/evil.sh │ │ Fails to validate│ │ • Code execution│
│ • Symlinks │ │ extraction paths│ │ • Privilege esc.│
└─────────────────┘ └─────────────────┘ └─────────────────┘
```
## 🛠️ API Endpoints
### `POST /api/scan`
Upload and scan a ZIP file for vulnerabilities.
**Request**: Multipart form data with `zipfile` field
**Response**:
```json
{
"filename": "test.zip",
"totalEntries": 10,
"suspicious": [...],
"riskLevel": "HIGH",
"recommendations": [...],
"metadata": {
"totalSize": 12345,
"suspiciousPatterns": {...}
}
}
```
### `GET /api/vulnerability-info`
Retrieve detailed information about CVE-2023-52169.
**Response**:
```json
{
"cve": "CVE-2023-52169",
"cvssScore": 7.8,
"downloadUrl": "https://www.7-zip.org/download.html",
"references": [...]
}
```
### `POST /api/create-test-zip`
Generate a test ZIP file containing various vulnerability patterns.
**Response**: ZIP file download with malicious entries for testing
## 🏗️ Architecture
### Frontend Stack
- **HTML5** - Semantic, accessible markup
- **CSS3** - Advanced animations, Grid/Flexbox layouts, custom properties
- **Vanilla JavaScript** - No frameworks, optimized performance
- **Canvas API** - Matrix rain effect rendering
- **Web APIs** - File API, Intersection Observer, Performance API
### Backend Stack
- **Node.js** - Runtime environment
- **Express.js** - Web framework with middleware
- **Multer** - File upload handling
- **yauzl** - ZIP file parsing and analysis
- **Archiver** - ZIP file creation for test files
### Security Middleware
- **Helmet** - Security headers
- **CORS** - Cross-origin resource sharing
- **Rate Limiting** - Request throttling
- **File Validation** - Type and size checks
## 🎨 Styling & Animations
### CSS Architecture
```
public/css/
├── styles.css # Main stylesheet with CSS custom properties
├── animations/ # Animation keyframes and transitions
├── components/ # Component-specific styles
└── responsive/ # Media queries and responsive design
```
### Animation System
- **Matrix Rain** - Canvas-based falling character effect
- **Particle System** - Floating elements with physics
- **Scroll Animations** - Intersection Observer triggered effects
- **Micro-interactions** - Hover states, button feedback, loading states
### Design Tokens
```css
:root {
--primary: #00ff88; /* Neon green */
--secondary: #ff4757; /* Danger red */
--accent: #3742fa; /* Electric blue */
--bg-primary: #0a0a0a; /* Deep black */
--text-primary: #ffffff; /* Pure white */
}
```
## 🔧 Configuration
### Environment Variables
```bash
PORT=3000 # Server port
NODE_ENV=production # Environment mode
UPLOAD_LIMIT=52428800 # File size limit (50MB)
RATE_LIMIT_WINDOW=900000 # Rate limiting window (15min)
RATE_LIMIT_MAX=50 # Max requests per window
```
### Security Configuration
The application includes multiple security layers:
```javascript
// Content Security Policy
helmet({
contentSecurityPolicy: {
directives: {
defaultSrc: ["'self'"],
styleSrc: ["'self'", "'unsafe-inline'"],
// ... additional directives
}
}
})
```
## 🧪 Testing
### Manual Testing
1. **Upload legitimate ZIP files** - Should show "Safe" results
2. **Upload test malicious ZIP** - Use the "Create Test ZIP" button
3. **Test file validation** - Try uploading non-ZIP files
4. **Test size limits** - Upload files > 50MB
### Creating Test Files
```bash
# Create a test ZIP with vulnerabilities
npm run create-test-zip
# The generated file will contain:
# - Path traversal entries (../)
# - Absolute paths (/tmp/, C:\)
# - Symlink entries
# - Long path names
# - Executable files
```
## 🚀 Deployment
### Production Checklist
- [ ] Set `NODE_ENV=production`
- [ ] Configure reverse proxy (nginx)
- [ ] Enable HTTPS/SSL certificates
- [ ] Set up monitoring and logging
- [ ] Configure firewall rules
- [ ] Set resource limits
- [ ] Enable compression
### Docker Deployment
```dockerfile
FROM node:18-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
EXPOSE 3000
CMD ["node", "server.js"]
```
### Docker Compose
```yaml
version: '3.8'
services:
se7enslip:
build: .
ports:
- "3000:3000"
environment:
- NODE_ENV=production
volumes:
- ./uploads:/app/uploads
```
## 🔗 References & Resources
### Official Documentation
- [7-Zip Official Website](https://www.7-zip.org/)
- [7-Zip Security History](https://www.7-zip.org/history.txt)
- [CVE-2023-52169 Details](https://nvd.nist.gov/vuln/detail/CVE-2023-52169)
### Security Resources
- [NIST Vulnerability Database](https://nvd.nist.gov/)
- [MITRE CVE Program](https://cve.mitre.org/)
- [OWASP Security Guidelines](https://owasp.org/)
### Technical References
- [ZIP File Format Specification](https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT)
- [Symlink Attack Techniques](https://en.wikipedia.org/wiki/Symbolic_link#Security)
- [Path Traversal Vulnerabilities](https://owasp.org/www-community/attacks/Path_Traversal)
## 🤝 Contributing
### Development Workflow
1. Fork the repository
2. Create feature branch (`git checkout -b feature/amazing-feature`)
3. Commit changes (`git commit -m 'Add amazing feature'`)
4. Push to branch (`git push origin feature/amazing-feature`)
5. Open Pull Request
### Code Style Guidelines
- Use ESLint configuration
- Follow semantic commit messages
- Add JSDoc comments for functions
- Include unit tests for new features
## 📄 License
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
## ⚠️ Disclaimer
**Educational Purpose Only**: This tool is designed for security research and education. The test ZIP files generated contain simulated malicious patterns for demonstration purposes. Do not use this tool for malicious activities. Always ensure you have proper authorization before testing security tools.
## 🎯 Roadmap
### Upcoming Features
- [ ] **Multi-format Support** - RAR, TAR, 7Z analysis
- [ ] **API Authentication** - JWT-based auth system
- [ ] **Batch Processing** - Multiple file analysis
- [ ] **PDF Reports** - Exportable security reports
- [ ] **Real-time Monitoring** - Live threat detection
- [ ] **Integration APIs** - Third-party security tools
### Performance Improvements
- [ ] **Worker Threads** - Background processing
- [ ] **Caching Layer** - Redis-based result caching
- [ ] **Stream Processing** - Large file handling
- [ ] **CDN Integration** - Static asset optimization
---
<div align="center">
**🔒 Stay Secure, Stay Updated**
[Download Latest 7-Zip](https://www.7-zip.org/download.html) | [Report Issues](https://github.com/your-repo/issues) | [Security Contact](mailto:security@example.com)
</div>
[4.0K] /data/pocs/17f14446a8c1f2354a25693cf4ffec6bbf67ba88
├── [ 847] package.json
├── [ 68K] package-lock.json
├── [4.0K] public
│ ├── [4.0K] css
│ │ └── [ 25K] styles.css
│ ├── [ 16K] index.html
│ └── [4.0K] js
│ ├── [9.9K] animations.js
│ ├── [9.0K] app.js
│ ├── [1.7K] matrix.js
│ ├── [1.8K] particles.js
│ └── [ 15K] scanner.js
├── [ 10K] README.md
├── [7.5K] server.js
├── [4.0K] utils
│ ├── [4.3K] manual-scanner.js
│ ├── [ 266] scanner.js
│ ├── [6.4K] zipCreator.js
│ └── [3.3K] zipScanner.js
└── [1.3K] zipCreator.js
4 directories, 16 files