Arbitrary File Write Vulnerability in Pivotal Spring Integration ZIP
CVE-2018-1263

4.7MEDIUM

Key Information:

Vendor

Pivotal

Status
Spring Integration Zip
Vendor
CVE Published:
15 May 2018

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-1263?

The Pivotal Spring Integration ZIP component, prior to version 1.0.2, contains an arbitrary file write vulnerability. This issue allows attackers to create files outside of intended directories by exploiting specially crafted zip archives. These archives may utilize various formats such as bzip2, tar, xz, war, cpio, and 7z, which include path traversal filenames. When the filenames are concatenated with the target extraction directory, this vulnerability enables an attacker to write files to unauthorized locations on the server.

Affected Version(s)

Spring Integration Zip versions prior to 1.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-1263-Demo
Created by sakib570

References

http://www.securityfocus.com/bid/104179
vdb-entryx_refsource_BID
https://pivotal.io/security/cve-2018-1263
x_refsource_CONFIRM

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.