GHSA-p634-w6r4-rjp2: Medium severity npm/adm-zip vulnerability
Summary
A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. getEntry(name) and extractAllTo() walk these two different internal structures, so they can each resolve a duplicate name to a different entry. An application that validates a named entry's contents via getEntry() before trusting an archive, then extracts the whole archive, can end up approving one file's content while a different file's bytes are what actually land on disk under that name.
Details - zipFile.js:58-83 retains both entries in entryList but overwrites entryTable[name] with only the last one written. - adm-zip.js:83-95,658-663 uses entryTable for getEntry() lookups — returns the last duplicate. - adm-zip.js:769-914 iterates entryList for extraction — writes the first duplicate (sync, default overwrite policy).
PoC js const AdmZip = require('adm-zip'); const z = new AdmZip({ noSort: true }); z.addFile('a.txt', Buffer.from('FIRST')); z.addFile('b.txt', Buffer.from('SECOND')); const raw = Buffer.from(z.toBuffer()); // rename the a.txt entry to b.txt directly in the raw bytes for (let at = raw.indexOf('a.txt'); at >= 0; at = raw.indexOf('a.txt', at + 5)) { raw.write('b.txt', at); } const parsed = new AdmZip(raw, { noSort: true }); const validated = parsed.getEntry('b.txt').getData().toString(); parsed.extractAllTo(outDir, false); // validated === "SECOND", but the file written to disk === "FIRST"
Reproduced on the pinned commit (2b4d84087d45344643e0183756e19191d52815cc)
Impact An application that checks a named entry's content before trusting an untrusted ZIP, then extracts it, can be made to approve different bytes than what actually gets written to disk — the classic check/use split that this kind of validate-then-extract pattern relies on.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/adm-zipto a version that resolves this vulnerability.Fixed in 0.6.1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using npm/adm-zip are exposed when they validate or inspect a ZIP entry by name with getEntry(), then extract the archive with extractAllTo(). The risk is specifically that duplicate entry names can cause validation to apply to the last entry while extraction writes the first entry.
What must an attacker provide to exploit this?
An attacker needs to supply a crafted ZIP archive containing at least two entries with the same name and different contents. No authentication or user interaction is required according to the supplied severity vector, but exploitation has high attack complexity.
Are all ZIP extraction uses affected?
The described mismatch requires an application workflow that separately trusts content obtained through getEntry(name) and then extracts the complete archive. The provided information does not establish impact for applications that do not perform that validation-and-extraction sequence.
How can I determine whether my application is vulnerable?
Review code handling untrusted ZIP files for calls to getEntry() used to validate a named file before extractAllTo() is called on the same archive. Test with an archive containing duplicate names and differing contents to determine whether the validated entry differs from the file written to disk.
What remediation is available?
A release reference is provided for adm-zip v0.6.1, along with the fixing commit 05101d47b3b983b705cc3e66fc34366118ba7b99. If updating cannot happen immediately, avoid trusting name-based getEntry() validation before whole-archive extraction, and reject archives with duplicate entry names where possible.