Attack Chain

1. Attacker crafts a malicious ZIP archive with mismatched CDFH and LFH filenames.
2. CDFH is configured to contain a benign filename (e.g., doc_report.pdf).
3. LFH is configured to contain a malicious path (e.g., /home/user/.ssh/authorized_keys or a system startup script).
4. The victim or a gateway security appliance inspects the ZIP archive using a parser that only validates the CDFH.
5. The security inspection concludes the archive is safe.
6. The target application uses ZipStreamReader to extract the archive.
7. The streaming extractor follows the LFH and overwrites a critical system or application file with attacker-controlled content.

Impact

Successful exploitation allows for arbitrary file overwrites, leading to potential Remote Code Execution (RCE) or security control bypass.

Recommendation

• Patch all projects using the Rust zip crate by updating the dependency to version 9.0.5 or newer.
• Audit existing infrastructure for applications that perform streaming extraction of user-supplied ZIP archives.
• Until patching is possible, implement validation logic that reconciles CDFH and LFH filenames before initiating extraction.
• Deploy the triage scanner provided by foxcornlab to audit Cargo.lock and suspicious ZIP archives for header mismatches.