| Description: | | ZipSlip attack is a classic path traversal technique that exploits vulnerabilities in compressed file processing. Its core mechanism involves constructing malicious compressed archives to bypass the system's predefined directory restrictions during decompression, enabling the writing or overwriting of files to sensitive system paths. This can ultimately lead to severe security consequences such as remote code execution and privilege escalation. Specifically, attackers embed path traversal sequences in filenames within the compressed archive. For example, using ../ for Linux/Unix systems or ..\ for Windows systems, they construct malicious paths like ../../etc/passwd (Linux) or ..\windows\system32\config\system (Windows). These filenames appear normal but actually contain logic to traverse upward through directory hierarchies.When a vulnerable decompression program processes such a malicious archive, if it fails to strictly validate and normalize file paths, it will execute decompression based directly on the malicious paths in the filenames. Normally, all files should be restricted to a predefined target directory. However, due to the lack of proper validation mechanisms, the program parses and executes the path traversal instructions, resulting in files being written outside the target directory to critical system locations (e.g., system configuration directories, executable file directories), thereby creating security risks. |