ZipSlip directory traversal cannot reach root directory

Question

I have discovered a ZipSlip vulnerability in a web application. Simply put, ZipSlip is basically a directory traversal through a specially crafted zip file, which is made to contain "../" inside, in order to extract to an arbitrary directory.

I have deployed the vulnerable application using Docker. The attack is executed successfully, the file can be extracted several directories below the original one. However, I cannot access the root directory of the docker image.

Let's assume the following directory tree: root -> folder1 -> folder2 -> folder3

The file is supposed to extract in folder3. Using my malicious zip I can extract the contents in folder2 and folder1. But if I put more "../" to reach root and then some other folder in the root level, I cannot.

I'm trying to figure out what is the measure in place that prevents me from reaching the root directory.

Answer 1

I'm trying to figure out what is the measure in place that prevents me from reaching the root directory.

Not enough is known about your specific setup, so one can only speculate. But I would guess that these are simply file system permissions. A web application is commonly run with reduced privileges, so that it cannot write to arbitrary path on the file system. And the file system protections of the directories near root are usually set to allow only writes by privileged users, since otherwise it would be possible for unprivileged users to replace common binaries, configurations or log data.