Path Traversal Vulnerability in rubyzip

rubyzip versions prior to 3.4.0 contain a critical path traversal vulnerability in the Zip::Entry#extract method. The library fails to perform robust validation when checking destination paths, specifically failing to account for cases where prefix comparison is performed without trailing directory separators. An attacker can create a specially crafted ZIP archive containing entries with path traversal sequences such as ../ in the filename. When an application using an affected version of rubyzip extracts such an archive, the library may incorrectly resolve the target path to a location outside the designated extraction directory. By targeting sensitive directories, an attacker could potentially overwrite configuration files, inject scripts into startup folders, or gain arbitrary code execution depending on the application's environment and permissions.

Impact

Successful exploitation allows for unauthorized file writes on the host system. Depending on the target application's use case, this can lead to remote code execution, persistence, or configuration tampering. The vulnerability affects any application or service utilizing the rubyzip library for processing untrusted archive uploads.

Recommendation

• Update the rubyzip dependency to version 3.4.0 or later across all projects.
• Audit applications utilizing rubyzip for file extraction to identify if archives are processed from untrusted user inputs.
• Implement file path validation at the application level to ensure extracted file paths reside within the expected destination directory.