CVE-2018-8416

Vulnerability

A tampering vulnerability exists in .NET Core 2.1 when System.IO.Compression.ZipFile improperly handles specially crafted ZIP files [3]. This affects .NET Core applications using the Microsoft.NETCore.App package versions 2.1.0 through 2.1.6 [3]. The vulnerable component is the ZIP extraction functionality.

Exploitation

An attacker must send a specially crafted ZIP file to a vulnerable application that extracts it using System.IO.Compression.ZipFile [3]. The attacker requires no special privileges beyond the ability to deliver the file (e.g., via upload, email, or network share). The exploitation does not require user interaction beyond the extraction process [2][3].

Impact

Successful exploitation allows an attacker to write arbitrary files and directories to certain locations on the system, though the destination is limited [3]. This could lead to tampering of application or system files, potentially enabling further compromise such as privilege escalation or code execution [2][3].

Mitigation

The vulnerability is fixed in .NET Core 2.1.7 [3]. Users should update the Microsoft.NETCore.App package to version 2.1.7 or later [3]. If the application does not extract ZIP files, it is unaffected [3]. For Red Hat Enterprise Linux, the fix is included in rh-dotnet21-dotnet-2.1.500-5.el7 [2].