Overview

This repository provides samples of archive files in various formats that attempt to exploit (hypothetical) directory traversal bugs:

• Leading slash:

  -rw-r--r--  /tmp/moo
  

  7zip ar arc arj cab cpio rar tar zip zoo

• Multiple leading slashes:

  -rw-r--r--  //tmp/moo
  

  ar arc arj cab cpio rar tar zip zoo

• Leading dot-dot:

  -rw-r--r--  ../moo
  

  7zip ar arc arj cab cpio rar tar zip zoo

• Non-leading dot-dot:

  -rw-r--r--  tmp/../../moo
  

  7zip ar arj cab cpio rar tar zip zoo

• File symlink:

  lrwxrwxrwx  moo -> /tmp/moo
  -rw-r--r--  moo
  

  7zip arj cpio rar tar zip

• Directory symlink:

  lrwxrwxrwx  tmp -> /tmp
  -rw-r--r--  tmp/moo
  

  7zip arj cpio rar tar zip

• Two directory symlinks (variant A):

  lrwxrwxrwx  cur -> .
  lrwxrwxrwx  par -> cur/..
  -rw-r--r--  par/moo
  

  7zip arj cpio rar tar zip

• Two directory symlinks (variant B):

  lrwxrwxrwx  cur -> .
  lrwxrwxrwx  cur/par -> ..
  -rw-r--r--  par/moo
  

  7zip arj cpio rar tar zip

Found bugs

The samples helped find the following bugs:

• ARJ:
  • https://bugs.debian.org/774434 [CVE-2015-0556]
  • https://bugs.debian.org/774435 [CVE-2015-0557]
  • https://bugs.debian.org/867520
• Zoo:
  • https://bugs.debian.org/774453
• ARC:
  • https://bugs.debian.org/774527 [CVE-2015-9275]
• gcab:
  • https://bugs.debian.org/774580 [CVE-2015-0552]
• UnRAR:
  • https://www.openwall.com/lists/oss-security/2017/08/14/3 [CVE-2017-12938]
• Perl (Archive::Tar):
  • https://bugs.debian.org/900834 [CVE-2018-12015]
• GNOME Nautilus:
  • https://bugs.debian.org/878012
• Ark:
  • https://bugs.debian.org/878269
• archiver:
  • mholt/archiver#69