Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-1000544

CVE-2018-1000544:
Rubyzip gem contains a Directory Traversal vulnerability in zip file component

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2018-1000544
GHSA ID
GHSA-vqcq-mrmw-mcmg
EPSS Score
0.6565%
CWE
CWE-59
Published
9/6/2018
Updated
8/28/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
rubyziprubygems<= 1.2.11.2.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper path sanitization when extracting zip entries. The Zip::Entry#extract method directly uses the entry's filename to write files, allowing malicious paths. Zip::File#extract orchestrates this process without additional safeguards. This matches the CVE description of directory traversal via crafted filenames and aligns with the PoC in rubyzip/rubyzip#369 where extraction logic is exploited. The functions are core to the library's file handling, making them clear candidates.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

ru*yzip **m ru*yzip v*rsion *.*.* *n* **rli*r *ont*ins * *ir**tory Tr*v*rs*l vuln*r**ility in Zip::*il* *ompon*nt t**t **n r*sult in writ* *r*itr*ry *il*s to t** *il*syst*m. T*is *tt**k *pp**r to ** *xploit**l* vi* I* * sit* *llows uplo**in* o* .zip

Reasoning

T** vuln*r**ility st*ms *rom improp*r p*t* s*nitiz*tion w**n *xtr**tin* zip *ntri*s. T** `Zip::*ntry#*xtr**t` m*t*o* *ir**tly us*s t** *ntry's *il*n*m* to writ* *il*s, *llowin* m*li*ious p*t*s. `Zip::*il*#*xtr**t` or***str*t*s t*is pro**ss wit*out **