CVE-2018-1002200 PoC — plexus-archiver 路径遍历漏洞

Source

https://github.com/shoucheng3/codehaus-plexus__plexus-archiver_CVE-2018-1002200_3-5

Associated Vulnerability

Title:plexus-archiver 路径遍历漏洞 (CVE-2018-1002200)
Description:plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Readme

Plexus-archiver
===============

[![Apache License, Version 2.0, January 2004](https://img.shields.io/github/license/codehaus-plexus/plexus-archiver.svg?label=License)](http://www.apache.org/licenses/)
[![Maven Central](https://img.shields.io/maven-central/v/org.codehaus.plexus/plexus-archiver.svg?label=Maven%20Central)](http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22org.codehaus.plexus%22%20a%3A%22plexus-archiver%22)
[![Build Status](https://travis-ci.org/codehaus-plexus/plexus-archiver.svg?branch=master)](https://travis-ci.org/codehaus-plexus/plexus-archiver)

The current master is now at https://github.com/codehaus-plexus/plexus-archiver

## Release Notes

You can find details about the different releases in the [Release Notes](https://github.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md).

 * [Release 3.4](https://github.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#release-34).
 * [Release 3.3](https://github.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#release-33).
 * [Release 3.2](https://github.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#release-32).

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →