[Swift]: Unsafe Unpacking Query
maikypedia opened this issue · 7 comments
Query PR
Language
Swift
CVE(s) ID list
CWE
CWE-022
Report
This query covers Unsafe Unpack vulnerability, unpacking from a malicious zip without properly validating that the destination file path
is within the destination directory, or allowing symlinks to point to files outside the extraction directory,
allows an attacker to extract files to arbitrary locations outside the extraction directory. Leading to overwrite sensitive user data and, in some cases, can lead to remote code execution.
I used a dataflow configuration looking for RemoteFlowSource flowing to the package unzipping. As Zip and ZIPFoundation only accept file paths and not raw data, I have introduced UnsafeUnpackAdditionalDataFlowStep to address scenarios where the file is downloaded remotely, ensuring that the remote file destination path is utilized in the unpacking process.
Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).
- Yes
- No
Blog post link
No response
btw Swift is missing here :p
Your submission is now in status Query review.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
Your submission is now in status Final decision.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
Hi @maikypedia
The submission cannot move forward to payment before the PR is merged.
There are a few minor comments to the PR before it gets merged, can you please address them?
Your submission is now in status Pay.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
Created Hackerone report 2372436 for bounty 550872 : [802] [Swift]: Unsafe Unpacking Query
Your submission is now in status Closed.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed