Vulnerability DatabaseCVE-2024-48510

CVE-2024-48510:
C# vulnerability analysis and mitigation

Overview

A Directory Traversal vulnerability has been identified in DotNetZip versions 1.16.0 and earlier, tracked as CVE-2024-48510. The vulnerability allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component. This vulnerability specifically affects products that are no longer maintained by the maintainer, as the repository has been marked as read-only and the package is considered legacy on NuGet (NuGet Package, NIST NVD).

Technical details

The vulnerability is classified as a path traversal issue (CWE-22) that affects the extraction functionality in DotNetZip. The CVSS v3.1 base score is 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating the highest severity level. The vulnerability exists in the destination path handling during extraction, where the path is mutated after sanitization, effectively bypassing the security measures previously implemented to fix CVE-2018-1002205 (GitHub Advisory).

Impact

The vulnerability allows attackers to execute arbitrary code through path traversal, potentially leading to complete system compromise. This is particularly severe as it affects all versions of DotNetZip from 1.10.1 through 1.16.0, which are widely used in various applications. The package has over 62.4 million total downloads on NuGet, indicating significant exposure (NuGet Package).

Mitigation and workarounds

The recommended mitigation is to migrate code to System.IO.Compression, as DotNetZip is no longer maintained. For systems that cannot immediately migrate, a patch has been provided by the security researcher, though it should be considered a temporary solution during the transition period. Microsoft Azure Functions users experiencing this vulnerability can mitigate it by either editing the package.json to remove the Dev Dependency or running 'npm uninstall azure-functions-core-tools --save-dev' as part of the Docker File (Microsoft Q&A).

Community reactions

The vulnerability has gained attention in the Microsoft ecosystem, particularly affecting Azure Functions users. The Azure Functions engineering team has acknowledged the issue and is working on a fix to be included in future releases of core tools, though no specific timeline has been provided (Microsoft Q&A).