CVE-2021-32842: 
C# vulnerability analysis and mitigation

SharpZipLib (or #ziplib), a Zip, GZip, Tar and BZip2 library, was found to contain a path traversal vulnerability tracked as CVE-2021-32842. The vulnerability affected versions 0.86.0 through 1.3.1, where the ZIP extraction directory path was not enforced to be slash terminated. This security issue was discovered and reported by Jaroslav Lobačevski from the GitHub Security Lab team (GitHub Security Lab).

The vulnerability stems from a security check implementation that was added in version 1.0.0 to verify if the destination file is under the destination directory. However, the implementation did not enforce that the _baseDirectory ends with a slash. This oversight meant that if the _baseDirectory path was not slash-terminated (e.g., '/home/user/dir'), it was possible to create a file with a name that begins as the destination directory one level up from the directory (e.g., '/home/user/dir.sh'). The vulnerability is classified as CWE-22 (Path Traversal) (NVD CNA Status).

The impact of this vulnerability is limited by file name and destination directory constraints. The arbitrary file creation capability depends on the specific use case, but could potentially allow attackers to create files in unintended locations, which might lead to security implications depending on the context of the application (GitHub Security Lab).

The vulnerability could be exploited by crafting specific ZIP files that take advantage of the non-slash-terminated base directory path validation issue. The exploitation would allow creation of files with names that begin with the destination directory path but actually reside one level up from the intended directory (GitHub Security Lab).

The vulnerability was fixed in SharpZipLib version 1.3.3, released on September 19, 2021. Users are advised to upgrade to this version or later to address the security issue. The fix includes improvements to path traversal validation (SharpZipLib Release).