Listen to this Post
How the CVE Works:
The vulnerability resides in GuardDog’s `safe_extract()` function within guarddog/utils/archives.py. While it securely extracts TAR archives using the `tarsafe` library which validates file sizes, its handling of ZIP archives is insecure. When processing a ZIP file (like Python wheels or eggs), the function uses Python’s standard `zipfile.ZipFile.extract()` method in a loop without any validation checks. An attacker can craft a malicious package containing a ZIP bomb—a file with extreme compression ratios. During extraction, the small compressed payload decompresses into gigabytes of data, such as a file filled with repeated null bytes. The function does not enforce limits on decompressed size, compression ratio, total file count, or cumulative extracted size, leading to immediate and exhaustive consumption of available disk space on the target system.
DailyCVE Form:
Platform: GuardDog
Version: 0.4.0
Vulnerability: Zip Bomb
Severity: High
Date: 2024-08-20
Prediction: 2024-09-15
What Undercode Say:
Create a zip bomb test file (42.zip technique) dd if=/dev/zero bs=1M count=10240 | gzip > bomb.gz zip bomb.zip bomb.gz Simulating resource exhaustion during scan guarddog scan ./malicious-package.whl Check disk usage spike df -h .
Vulnerable code snippet (guarddog/utils/archives.py) elif zipfile.is_zipfile(source_archive): with zipfile.ZipFile(source_archive, "r") as zip: for file in zip.namelist(): zip.extract(file, path=os.path.join(target_directory, file)) No size checks
How Exploit:
Malicious PyPI/npm package upload. CI/CD pipeline integration. Local package analysis trigger.
Protection from this CVE:
Implement decompressed size limits. Validate compression ratios. Use safe extraction library. Add file count limits.
Impact:
CI/CD Pipeline Disruption. Local Disk Exhaustion. Supply Chain Attack Amplification.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
