mitre / mitre/secure-coding-case-studies
Proposal: Case Study on CVE-2018-1002200 (Zip Slip in plexus-archiver)
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 11
- Forks
- 45
- PR merge metrics
- No merged PRs in 30d
Description
Description:
We propose to create a secure coding case study on CVE-2018-1002200, a Zip Slip vulnerability in plexus-archiver.
The core coding mistake is improper validation of archive entry paths during extraction. A malicious archive can include ../ path sequences, allowing files to be written outside the intended destination directory.
We think this makes a strong case study because the mistake is concrete, the exploit path is easy to explain, and the prevention measures are practical: validate and normalize paths before extraction and reject entries that escape the target directory.
Team Members:
- Bhanu Prakash Reddy Ramidi (G01568334)
- Samay Salveru (G01586013)
We plan to proceed with this case study unless there are objections.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the repository's existing case-study format, then research CVE-2018-1002200 and the plexus-archiver Zip Slip scenario described in the issue. Create a case study explaining the archive-entry path mistake, the ../ traversal exploit, and prevention through path validation and normalization; it is done when those points are clearly covered in the project's format.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100