6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-0450

CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.2, 3.11.8, 3.10.13, 3...

An issue was found in the CPython zipfile module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior.

The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-0450

CVE-2024-0450:

6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the CPython zipfile module's handling of "quoted-overlap" zip bombs, where entries in a ZIP archive are crafted to overlap. The provided patches (e.g., commit 66363b9a7b9fe7c99eba3a185b74c5fdbf842eba and its cherry-picks) show modifications primarily in two methods of the ZipFile class:

_RealGetContents: This method parses the ZIP file's central directory. The patch modifies it to calculate an _end_offset for each file entry. This offset indicates the boundary of the current entry's data. Before this change, this crucial piece of information for detecting overlaps was not computed.
open: This method is used to open a specific file within the archive. The patch introduces a check using the newly computed _end_offset and the entry's compress_size to determine if reading this entry would cause an overlap with subsequent data. If an overlap is detected, a BadZipFile exception is raised.

The function zipfile.ZipFile.open is identified as directly vulnerable because, prior to the patch, it would proceed to allow access to an overlapping entry without any checks, leading to the zip bomb condition when the entry's data was subsequently read. The function zipfile.ZipFile._RealGetContents is identified because it processes the malicious ZIP structure (the central directory defining the overlaps) and, in its vulnerable state, failed to prepare the necessary data (_end_offset) that open would need to perform the overlap check. Thus, it was an essential part of the vulnerable processing chain. The file paths Lib/zipfile/__init__.py (for newer versions/main branch) or Lib/zipfile.py (for older versions) are where these methods reside. The analysis uses Lib/zipfile/__init__.py based on the primary development commit.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.