VAITP Dataset

← Back to the dataset

CVE-2023-45853

MiniZip heap overflow via long filename/comment/extra field in zlib through 1.3.

  • CVSS 9.8
  • CWE-190
  • Memory Corruption
  • Remote

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

CVE
CVE-2023-45853
CWE
CWE-190
CVSS base score
9.8
Published
2023-10-14
OWASP
A04 Insecure Design
Orthogonal defect classification
Algorithm
Code defect classification
Incorrect Algorithm
Category
Memory Corruption
Subcategory
Integer Overflows
Accessibility scope
Remote
Impact
Arbitrary Code Execution
Affected component
zlib pyminiz
Fixed by upgrading
Yes

Solution

Upgrade zlib to 1.3.1 or later.

Vulnerable code sample

import zlib
import struct

def zipOpenNewFileInZip4_64(zipFile, filename, compress_type=zlib.DEFLATED, level=6, comment='', extra_field=b''):
    # VULNERABLE: This code is susceptible to path traversal
    filename_encoded = filename.encode()
    comment_encoded = comment.encode()

    filename_len = len(filename_encoded)
    comment_len = len(comment_encoded)
    extra_field_len = len(extra_field)

    file_header = b""
    file_header += b"\x50\x4b\x03\x04"
    file_header += b"\x14\x00"
    file_header += b"\x00\x00"
    file_header += struct.pack("<H", compress_type)
    file_header += b"\x00\x00\x00\x00"
    file_header += b"\x00\x00\x00\x00"
    file_header += b"\x00\x00\x00\x00"
    file_header += struct.pack("<H", filename_len)
    file_header += struct.pack("<H", extra_field_len)
    
    zipFile.write(file_header)
    zipFile.write(filename_encoded)
    zipFile.write(extra_field)

    return zipFile

def create_zip(filename="example.zip"):
  with open(filename, "wb") as f:
    long_filename = "A" * 65535
    zipOpenNewFileInZip4_64(f, long_filename)

if __name__ == "__main__":
    create_zip()
    print("ZIP file created: example.zip")

Patched code sample

import zlib
import struct

def zipOpenNewFileInZip4_64(zipFile, filename, compress_type=zlib.DEFLATED, level=6, comment='', extra_field=b''):
    # SECURE: This version prevents path traversal
    filename_encoded = filename.encode()
    comment_encoded = comment.encode()

    filename_len = len(filename_encoded)
    comment_len = len(comment_encoded)
    extra_field_len = len(extra_field)

    if filename_len > 255:
        filename_len = 255

    file_header = b""
    file_header += b"\x50\x4b\x03\x04"
    file_header += b"\x14\x00"
    file_header += b"\x00\x00"
    file_header += struct.pack("<H", compress_type)
    file_header += b"\x00\x00\x00\x00"
    file_header += b"\x00\x00\x00\x00"
    file_header += b"\x00\x00\x00\x00"
    file_header += struct.pack("<H", filename_len)
    file_header += struct.pack("<H", extra_field_len)
    
    zipFile.write(file_header)
    zipFile.write(filename_encoded[:255])
    zipFile.write(extra_field)

    return zipFile

def create_zip(filename="example.zip"):
  with open(filename, "wb") as f:
    long_filename = "A" * 65535
    zipOpenNewFileInZip4_64(f, long_filename)

if __name__ == "__main__":
    create_zip()
    print("ZIP file created: example.zip")

Payload

# Filename is designed to cause an integer overflow
filename = b"A" * 65535 * 2

Cite this entry

@misc{vaitp:cve202345853,
  title        = {{MiniZip heap overflow via long filename/comment/extra field in zlib through 1.3.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-45853},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-45853/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::