CVE-2024-5569

DoS vulnerability in jaraco/zipp leads to infinite loop in zip file processing.

• CVSS 6.2
• CWE-835
• Resource Management
• Remote

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

CVE

CVE-2024-5569

CWE

CWE-835

CVSS base score

6.2

Published

2024-07-09

OWASP

A10 Insufficient Logging & Monitoring

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

jaraco/zipp

Fixed by upgrading

Yes

Solution

Upgrade to version 3.19.1 or later of the jaraco/zipp library.

import zipfile
from pathlib import Path

def process_zip(zip_path):
    with zipfile.ZipFile(zip_path) as z:
        for file_info in z.infolist():
            path = Path(file_info.filename)
            new_path = Path('/some/base/path') / path
            while True:
                pass 

process_zip('path/to/zip_file.zip')

import zipfile
from pathlib import Path
import os

def process_zip(zip_path, extract_to_path):
    if not Path(zip_path).exists():
        print(f"Error: The zip file {zip_path} does not exist.")
        return

    extract_to_path = Path(extract_to_path).resolve()

    if not extract_to_path.exists():
        print(f"Error: The extraction path {extract_to_path} does not exist.")
        return

    with zipfile.ZipFile(zip_path, 'r') as z:
        for file_info in z.infolist():
            path = Path(file_info.filename)

            new_path = extract_to_path / path

            if not new_path.resolve().startswith(extract_to_path.resolve()):
                print(f"Skipping potentially dangerous file: {file_info.filename}")
                continue
            
            if file_info.is_dir():
                new_path.mkdir(parents=True, exist_ok=True)
            else:
                with z.open(file_info) as source_file, open(new_path, 'wb') as dest_file:
                    dest_file.write(source_file.read())
            
            print(f"Extracted: {new_path}")

process_zip('path/to/zip_file.zip', '/some/base/path')

import zipfile
import io

# Create a specially crafted zip file that triggers the vulnerability
payload_zip = io.BytesIO()
with zipfile.ZipFile(payload_zip, 'w') as z:
    # Add a file with a name that causes the infinite loop
    z.writestr('a/' * 1000 + 'file.txt', 'This is a test.')

# Save the payload to a file
with open('vulnerable_payload.zip', 'wb') as f:
    f.write(payload_zip.getvalue())

@misc{vaitp:cve20245569,
  title        = {{DoS vulnerability in jaraco/zipp leads to infinite loop in zip file processing.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-5569},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-5569/}}
}