Cxf6e7f2c1-dc59 @ Npm-yauzl-2.10.0

[cyber-sast]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about Cxf6e7f2c1-dc59
Applications: Visão Geral
Checkmarx Project: takenet/blip-ds
Repository URL: https://github.com/takenet/blip-ds
Branch: master
Scan ID: 6f0d76c7-ef9a-4ef2-94dc-ca624d6b1227

---

The package yauzl is vulnerable to Arbitrary File Write implemented through improper validation of symlinks. The function validateFileName in the file index.js doesn't validate malicious symlink files when checking for path traversal attacks. It is possible to create a malicious archive containing symlinks which leads to the file decompression outside the original filesystem location. This can be abused to read/write files in an arbitrary location. This affects the three CIA impact metrics: Confidentiality, Integrity and Availability. All of the versions appear to be vulnerable, as the Issue still has not been addressed and no fix is available.

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH