I've seen lately some bugs that used zip symlink technique , can anyone explain how this vulnerability works , how attackers use it to exploit applications?
Symlinks are like shortcuts, so if you create a symlink pointing to /etc/passwd, when you open the symlink your O.S. will open /etc/passwd.
How the attack works?
1) Create a symlink in your computer to /etc/passwd
ln -s /etc/passwd ./symlink.jpg
2) Create a zip with the symlink
zip —symlinks -r photos.zip ./symlink.jpg
3) Upload the photos.zip to the target server.
Let's say the server unzip the file in the following address: vulnerable.com/user/10000/images/
If you access vulnerable.com/user/10000/images/symlink.jpg you will see the server's /etc/passwd.
Why do you need the zip trick?
If you upload the symlink direct to the target, in this case, you will actually be uploading your own /etc/passwd, so you need the zip (with the -symlink argument) to conserve the characteristics of your symlink.