Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue

Vulnerability

CVE-2023-27603 describes a Zip Slip vulnerability in Apache Linkis versions up to and including 1.3.1. The flaw resides in the Manager module's engineConn material upload functionality, which fails to validate the paths within uploaded ZIP archives. This allows an attacker to craft a malicious ZIP file with directory traversal entries (e.g., ../), leading to arbitrary file write outside the intended extraction directory [2].

Attack

Vector

The attack is initiated by sending a specially crafted ZIP file to the Manager module's upload endpoint. No authentication is explicitly required, but the attacker must have network access to the Linkis Manager service. The Zip Slip technique exploits the lack of path normalization or validation, enabling the extracted files to be placed in arbitrary locations on the server file system [3].

Impact

Successful exploitation can result in arbitrary file write, which may be leveraged to achieve remote code execution (RCE). By overwriting critical files such as application configuration or library files, an attacker could execute arbitrary code in the context of the Linkis server process [2][3].

Mitigation

Apache Linkis has addressed this issue in version 1.3.2. Users are strongly advised to upgrade to this version or later. No official workaround is available, making patch application the primary remediation [2][3].