Python "zipfile" can't detect "quoted-overlap" zipbomb that can be used as a DoS attack

Bug report

Bug description:

Just found this vulnerability in the latest Python 3.11.5 (and previous 3.10.10).

If we craft a zipbomb using the "quoted-overlap" way (as mentioned https://www.bamsoftware.com/hacks/zipbomb/), this can't be detected by Python's zip file and the zip will be extracted and thus potentially cause a DoS attack by consuming all the storage.

This issue is related to CVE-2019-9674 but not the same. CVE-2019-9674 is talking about the "normal" overlap-zipbomb which is a "full" overlap. This can already be detected by Python's new version of zipfile. However, when we craft a "quoted-overlap" zip, as indicated by https://www.bamsoftware.com/hacks/zipbomb/, python can't detect and happily starts to extract.

For example, the following is the python to extract a zip file, 116 KB before extraction, goes to as large as 17GB after extraction. The size after extraction can be easily increased to multi TBs or even PBs by adjusting the zip-creation.

import zipfile
import sys
import os

def extract_zip(zip_path):
    """
    Extracts the contents of a ZIP file to the current directory.

    :param zip_path: Path to the ZIP file
    """
    if not os.path.exists(zip_path):
        print(f"Error: {zip_path} does not exist.")
        return

    with zipfile.ZipFile(zip_path, 'r') as zip_ref:
        zip_ref.extractall()
        print(f"Extracted contents of {zip_path} to the current directory.")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python extract_zip.py <path_to_zip_file>")
        sys.exit(1)

    zip_file_path = sys.argv[1]
    extract_zip(zip_file_path)

CPython versions tested on:

3.11

Operating systems tested on:

Linux

Linked PRs

pythongh-109858: Protect zipfile from "quoted-overlap" zipbomb

As a workaround, the following check can be used before extracting a ZIP file.

# zipf is an open ZipFile
end_offset = zipf.start_dir
for zinfo in sorted(zipf.filelist,
                    key=lambda zinfo: zinfo.header_offset,
                    reverse=True):
    if zinfo.header_offset + zinfo.compress_size > end_offset:
        raise zipfile.BadZipFile('Overlapped entries')
    end_offset = zinfo.header_offset

Edited to remove a suggestion of using reversed rather than sorted. Assume that nefarious zips will intentionally not follow "normal" patterns of having the central directory in the same order, the sorting defends against that.

But if the ZIP file was modified in-place after creation, the order can be changed, so it is up to you whether you want to support such corner case.

Applications wanting to do that seem rare & overcomplicated enough that I'd just call that an application design issue corner case that we don't need to spend extra effort to worry about ourselves.

gh-109858: Protect zipfile from "quoted-overlap" zipbomb (GH-110016)

pythongh-109858: Protect zipfile from "quoted-overlap" zipbomb (pytho…

[3.8] pythongh-109858: Protect zipfile from "quoted-overlap" zipbomb (p…

Add @requires_zlib decorator for pythongh-109858 tests

Add @requires_zlib() decorator for pythongh-109858 tests

pythongh-109858: Protect zipfile from "quoted-overlap" zipbomb (pytho…

[3.8] pythongh-109858: Protect zipfile from "quoted-overlap" zipbomb (p…

Add @requires_zlib() decorator for gh-109858 tests (GH-113918)

[3.8] pythongh-109858: Protect zipfile from "quoted-overlap" zipbomb (p…

[3.12] gh-109858: Protect zipfile from "quoted-overlap" zipbomb (GH-1…

[3.11] gh-109858: Protect zipfile from "quoted-overlap" zipbomb (GH-1…

Backports already include the #113918 fix, so they can just be merged.

[3.8] gh-109858: Protect zipfile from "quoted-overlap" zipbomb (GH-11…

[3.9] gh-109858: Protect zipfile from "quoted-overlap" zipbomb (GH-11…

[3.10] gh-109858: Protect zipfile from "quoted-overlap" zipbomb (GH-1…

pythongh-109858: Protect zipfile from "quoted-overlap" zipbomb (pytho…

Add @requires_zlib() decorator for pythongh-109858 tests (pythonGH-11…

This is marked as a release blocker including the 3.11 tag but the issue is still open. It's there anything left here?

No. All necessary backports were merged. Thank you for the reminder.

pythongh-109858: Protect zipfile from "quoted-overlap" zipbomb (pytho…

Add @requires_zlib() decorator for pythongh-109858 tests (pythonGH-11…

Does anyone here have any contacts in GitHub who know about GHSA?

Their entry for this (CVE-2024-0450) GHSA-jm46-725r-hh9v says that 3.12.2 and 3.11.8 are vulnerable, but AFAICS those 2 versions contain the fix (see gh-109858 mentioned in 3.12.2 release notes and 3.11.8 release notes).

I've attempted to open an improvement PR here but I'm not sure if it will be accepted seeing as it says 'Unreviewed' and it seems python is not on the list of things they care about; because the "suggest improvements" button (via which I did it) forced me to select "Affected products" where [c]python was not an option 😢 the nearest thing was 'pip'.

AFAICS this GHSA data feeds through into tools like Grype which currently say "Fixed?"=unknown and have no "Fixed in" so it would be good to know how to correct the record on which python versions are vulnerable/fixed.

@sparrowt

Thanks for reporting this @sparrowt, I'll take a look and update the CVE records accordingly. In theory this will trickle down into GitHub Security Advisories as well since they source a lot of their information from that database.

Amazing thank you! I'm not sure how the affected versions / patched versions thing is going to work given GHSA seems to only support packages within certain 'ecosystems' but seemingly not the ecosystem runtime (e.g. python) itself:

I've fixed the metadata for the CVE. I believe the "syncing" process will happen outside of the manual update process but could be wrong? The GHSA team is aware of the whole ecosystem issue for updating GHSA records.

[3.8] pythongh-109858: Protect zipfile from "quoted-overlap" zipbomb (p…

Thanks! Sadly it's still wrong on GHSA-jm46-725r-hh9v

[CVE-2024-0450] Protect zipfile from "quoted-overlap" zipbomb

pythongh-109858: Protect zipfile from "quoted-overlap" zipbomb (pytho…

Add @requires_zlib() decorator for pythongh-109858 tests (pythonGH-11…

Navigation Menu

Repository navigation

Python "zipfile" can't detect "quoted-overlap" zipbomb that can be used as a DoS attack #109858

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Python "zipfile" can't detect "quoted-overlap" zipbomb that can be used as a DoS attack #109858

Description

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Activity

serhiy-storchaka commented on Sep 28, 2023

gpshead commented on Jan 2, 2024

serhiy-storchaka commented on Jan 11, 2024

pablogsal commented on Feb 5, 2024

serhiy-storchaka commented on Feb 5, 2024

sparrowt commented on Apr 3, 2024

sethmlarson commented on Apr 3, 2024

sparrowt commented on Apr 3, 2024

sethmlarson commented on Apr 3, 2024

sparrowt commented on May 15, 2024

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions