An attacker who can influence the list of files or paths passed to the bestzip API can provide a file path starting with a hyphen. Because the zip utility processes arguments in order, these attacker-supplied strings are interpreted as command options. By supplying the '-T' and '-TT' flags followed by a malicious command string, an attacker can coerce the zip utility to execute that command via a shell upon completion of the archive operation. This impacts applications that allow users to influence file names or directory paths that are subsequently processed by the bestzip library. Versions 2.2.6 and 3.0.2 introduced a fix by implementing the mandatory '--' delimiter.

Impact

Successful exploitation allows for arbitrary command execution on the host system with the privileges of the application process running the bestzip library. This vulnerability affects any Node.js application relying on bestzip to process untrusted file inputs, potentially leading to full system compromise, exfiltration of sensitive data, or lateral movement within the environment.

Recommendation

• Update the bestzip dependency to version 2.2.6 or 3.0.3 (or later) to ensure the '--' delimiter is correctly applied to system calls.
• Audit applications using bestzip to identify if user-provided file names or directory paths are passed to the library functions without server-side validation.
• Implement strict input validation or sanitization for all file paths before they are passed to archive-related APIs.
• Monitor for suspicious child process spawning originating from Node.js applications, specifically targeting the execution of 'zip' or 'unzip' with unusual command line arguments.