CVE-2018-1002202 PoC — zip4j 路径遍历漏洞

Source

https://github.com/shoucheng3/srikanth-lingala__zip4j_CVE-2018-1002202_1-3-2

Associated Vulnerability

Title: zip4j 路径遍历漏洞 (CVE-2018-1002202)
Description:zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Readme

# zip4j

This repository contains decompiled source code for the zip4j library versions 1.3.2 (vulnerable) and 1.3.3 (fixed) for CVE-2018-1002202, for the CWE-Bench-Java dataset. The original zip4j repository on Github doesn't include code from these versions.

## Versions

  ### Version 1.3.2 (Vulnerable)
  - **Tag**: `1.3.2`
  - **Status**: Contains path traversal vulnerability
  - **Source**: Decompiled from `zip4j-1.3.2-sources.jar` 
  - **Buggy Commit**: `d87ffa2d64ffb3a0a1cf0c7a69c7b19d7015bfde`
  - [1.3.2 sources jar download page](https://repo1.maven.org/maven2/net/lingala/zip4j/zip4j/1.3.2/)

  ### Version 1.3.3 (Fixed)
  - **Tag**: `1.3.3`
  - **Status**: Vulnerability patched
  - **Source**: Decompiled from `zip4j-1.3.3-sources.jar` 
  - **Fixed Commit**: `59aeea594ff885e06c25751dc6334dfea1bed8c6`
  - [1.3.3 sources jar download page](https://repo1.maven.org/maven2/net/lingala/zip4j/1.3.3/)

## Original Project

  - Original Author: Srikanth Lingala
  - [Original Repository](https://github.com/srikanth-lingala/zip4j)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →