8

I've seen lately some bugs that used zip symlink technique , can anyone explain how this vulnerability works , how attackers use it to exploit applications?

Thanks

14

Symlinks are like shortcuts, so if you create a symlink pointing to /etc/passwd, when you open the symlink your O.S. will open /etc/passwd.

How the attack works?

1) Create a symlink in your computer to /etc/passwd

e.g.: ln -s /etc/passwd ./symlink.jpg

2) Create a zip with the symlink

e.g.: zip —symlinks -r photos.zip ./symlink.jpg

3) Upload the photos.zip to the target server.

Let's say the server unzip the file in the following address: vulnerable.com/user/10000/images/

If you access vulnerable.com/user/10000/images/symlink.jpg you will see the server's /etc/passwd.

Why do you need the zip trick?

If you upload the symlink direct to the target, in this case, you will actually be uploading your own /etc/passwd, so you need the zip (with the -symlink argument) to conserve the characteristics of your symlink.

  • So, zip will only create symlinks if uncompressed with the -symlink option set? Sounds more like a feature than a vulnerability. But the outcome depend heavily on the context it is used in. – Dog eat cat world Nov 27 '14 at 8:49
  • 1
    @Dogeatcatworld No, it can be uncompressed without any special flag. – Lucas NN Nov 27 '14 at 16:55
  • Regarding uploading the symlink directly - what about locally broken symlinks? That wouldn't be broken on the target. – Bell Jun 2 '17 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.