CVE-2018-1000544

Vulnerability

The rubyzip gem version 1.2.1 and earlier contains a directory traversal vulnerability in the Zip::File component [1][2]. When extracting a specially crafted ZIP archive, the library does not properly sanitize entry names containing absolute paths (e.g., /tmp/file.txt) or path traversal sequences (e.g., ../../file) [3]. This allows an attacker to write arbitrary files to the filesystem [4].

Exploitation

An attacker can exploit this by uploading a malicious ZIP file to a site that accepts ZIP uploads and uses rubyzip to extract archives [1][4]. The crafted archive can contain entries with absolute paths or symlinks pointing outside the extraction directory [3]. For example, a symlink entry like path -> ../../../../tmp followed by a file path/file.txt causes rubyzip to write the file into /tmp [4]. No authentication is required beyond the ability to upload the ZIP file.

Impact

Successful exploitation allows an attacker to write arbitrary files to the filesystem at attacker-controlled locations [1][3]. This can lead to remote code execution if the attacker overwrites critical system files (e.g., cron jobs, config files, or executables) [2][4]. The impact is high, with potential for full system compromise.

Mitigation

The vulnerability is fixed in rubyzip version 1.2.2 and later [1][2]. Users should update to the latest version. Red Hat released RHSA-2018:3466 for affected products [1]. If upgrading is not possible, avoid processing untrusted ZIP files or implement external validation of entry paths. This CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.