UNSAFE ARCHIVE UNPACKING: LABS AND SEMGREP RULES

Summary from the TLDR InfoSec newsletter

Archive Path Traversal is a vulnerability that can occur when extracting an archive file if the implementation does not properly check that filename sequences don't exit the archive (ex: ../../evil). An intern at Doyensec created a project that provides Semgrep rules as well as a playground with various malicious archive files and vulnerable implementations to demonstrate this vulnerability. The post concludes by discussing path sanitization and path validation as possible mitigations.