Zip Slip Vulnerability: The Return of a Silent Threat

Overview

The Zip Slip vulnerability is back. First disclosed in 2018, Zip Slip is a path traversal flaw in archive extraction routines that lets attackers plant files outside intended directories. By disguising malicious entries inside compressed files, attackers can overwrite executables, drop backdoors, or compromise entire systems.

Fast forward to 2025, and security researchers are reporting fresh variants of Zip Slip emerging in modern CI/CD pipelines, cloud services, and supply chain attacks — showing how even “patched” vulnerabilities can quietly evolve.

Timeline of Zip Slip

June 2018 – Initial Discovery & Disclosure

• Researchers at Snyk Security first disclosed Zip Slip.

• Snyk’s whitepaper highlighted thousands of vulnerable projects across ecosystems.

2018–2020 – Real-World Exploitation

• Vulnerabilities were identified in Jenkins, Spring, Apache projects, AWS Toolkit, and Gradle.

• Exploits shared on HackerOne and reported by SonarSource confirmed its presence in widely used open-source software.

2021–2024 – Gradual Mitigation

• Many ecosystems (Java, Python, Node.js) patched major libraries.

• Security advisories emphasized validating extraction paths and sanitizing archives.

2025 – Resurgence

• New variants spotted in supply chain attacks (infected open-source packages).

• Cloud-native environments and file upload pipelines became prime targets.

• Renewed attention after multiple reports from CrowdStrike, Sprocket Security, and SonarSource documented ongoing exploitation attempts.

Technical Overview

Core Exploit

The attack hinges on path traversal strings inside archive entries:

../../../../etc/passwd
../../../../var/www/html/backdoor.php 

When decompressed by vulnerable routines, these entries are written outside the target directory.

Why It’s Dangerous

• Universal Risk → Affects ZIP, TAR, RAR, 7Z archives.

• Cross-Ecosystem → Found in Java, Python, .NET, Node.js, Ruby, Go.

• Easy Weaponization → Works via phishing, supply chain packages, or auto-unpacking web apps.

Example in Web Exploitation

• User uploads a .zip file to a vulnerable web app.

• The pipeline unpacks files into /uploads/.

• Malicious entry → ../../../../var/www/html/shell.php.

• Result → Webshell in production server root.

Impact

• High-profile projects: Jenkins, Spring, Apache Heron, Gradle, AWS Toolkit.

• Exploitation in upload interfaces: Malicious file uploads granting attackers webshells.

• Enterprise compromise: Reported in cloud platforms (via CVE-2022-40407, CVE-2022-21675).

• Supply chain risks: Infected packages propagated malware into build systems.

Defensive & Mitigation Strategies

The Zip Slip vulnerability is deceptively simple — attackers abuse poorly validated archive extraction paths. But defending against it requires layered strategies, spanning secure coding, dependency management, and operational controls.

Validate Extraction Paths (Core Fix)

Problem: Vulnerable libraries concatenate archive entry names with the target directory without validating them. Solution: Always resolve and sanitize file paths before writing.

Java Example (Safe Validation):

File targetFile = new File(destinationDir, zipEntry.getName());
String canonicalPath = targetFile.getCanonicalPath();

if (!canonicalPath.startsWith(destinationDir.getCanonicalPath() + File.separator)) {
    throw new IOException("Entry is outside the target dir: " + zipEntry.getName());
} 

Python Example (tarfile safe extract):

import os, tarfile

def is_within_directory(directory, target):
    abs_directory = os.path.abspath(directory)
    abs_target = os.path.abspath(target)
    return os.path.commonprefix([abs_directory, abs_target]) == abs_directory

def safe_extract(tar, path=".", members=None):
    for member in tar.getmembers():
        member_path = os.path.join(path, member.name)
        if not is_within_directory(path, member_path):
            raise Exception("Unsafe path detected: " + member.name)
    tar.extractall(path, members) 

Use Safe, Updated Libraries

• Use well-maintained libraries with built-in protections.

• Check Snyk vulnerability database or NVD before adopting third-party packages.

• Replace deprecated or insecure modules (adm-zip in Node.js, vulnerable tarfile in Python).

Examples of Safe Libraries (as of 2025):

• Java: Apache Commons Compress (patched versions)

• Python: zipfile (safe), tarfile (safe after patches)

• Node.js: yauzl, unzipper (patched)

Apply Least Privilege to Extraction Processes

• Run extraction under low-privilege users (sandbox/jail environment).

• Deny write access to sensitive directories (/etc/, /usr/bin/, /var/www/).

• Use Linux seccomp profiles or AppArmor policies to limit system calls.

Example (Linux sandbox):

# Create a low-privilege user for extraction
sudo useradd -r -s /usr/sbin/nologin unzipper

# Run extraction under restricted user
sudo -u unzipper unzip malicious.zip -d /tmp/safe_extract/ 

Monitor & Log Archive Extraction Events

• Enable detailed logging for file extraction utilities.

• Use File Integrity Monitoring (FIM) to detect changes in sensitive directories.

• Alert on anomalous writes during archive extraction (e.g., /etc/passwd, web roots).

SIEM Example Detection Rule:

IF process = unzip OR tar
AND file_write_directory NOT IN [/uploads, /tmp, /data]
THEN ALERT "Potential Zip Slip Exploit" 

Integrate Security Testing into CI/CD

• Add SAST (Static Application Security Testing) to catch unsafe path handling.

• Integrate dependency scanning tools (e.g., Snyk, Dependabot, OWASP Dependency-Check).

• Run DAST (Dynamic Testing) with malicious archive payloads during QA.

CI/CD Example with Snyk:

snyk test --all-projects 

Defense-in-Depth Approaches

Beyond technical fixes, organizations should adopt a layered defense strategy:

• Restrict Archive Uploads: Don’t accept ZIP/TAR unless business-critical.

• MFA for Admin Access: Prevent privilege escalation after exploitation.

• Endpoint Detection & Response (EDR): Identify unusual file system changes.

• Incident Response Playbooks: Include Zip Slip exploitation scenarios.

Why Zip Slip’s Return Matters in 2025

• Cloud-Native Risks → Archive processing in pipelines is now ubiquitous.

• Supply Chain Exposure → Malicious packages propagate infections silently.

• Legacy Meets Modern → Old vulnerabilities evolve with new attack surfaces.

• Simple but Effective → Exploit complexity is low, but damage is high.

As CrowdStrike warned in 2025:

“Attackers are opportunistic. Old vulnerabilities like Zip Slip never disappear — they resurface where defenses are weakest.”

Conclusion

The Zip Slip vulnerability proves that old flaws don’t die — they adapt. By exploiting poor path validation, attackers can turn something as harmless as a .zip into a weapon for system compromise.

The return of Zip Slip in 2025 underscores the reality that silent threats are often the most dangerous.

Key Sources & Reports:

• Snyk Research – Zip Slip Whitepaper

• Sophos – What You Need to Know

• HackerOne Report #362118

• SonarSource – OpenRefine Exploitation

• CrowdStrike – Preventing Zip File Exploitation

• Sprocket Security Blog (2025) – Zip Slip in File Uploads