I'm researching possible security risks when handling ZIP files, or archives in general, in web applications.
The scenario is the following. The user is able to upload any ZIP (or in general an archive) file, the web application extracts its contents and subsequently offers the extracted files to download again.
I've come across a number of possibilities this may be exploited.
- DoS with a ZIP bomb (e.g.
- Writing arbitrary files, with relative file paths (see evilarc)
- Reading arbitrary files, with symbolic links (see How zip symlink works?)
- I assume issues with polyglot ZIP files
The resources on the topic seem quite limited and I'm sure there's more risks associated.
What are possible security risks for web applications handling ZIP/archive files?
How can these be securely processed?