Drupal H5P Module 2.0.0 Zip Slip Traversal

——————————————————————
Drupal H5P Module <= 2.0.0 (isValidPackage) Zip Slip Vulnerability

——————————————————————

[-] Software link:

https://www.drupal.org/project/h5p

[-] Versions Affected:

Version 2.0.0-alpha2 or earlier versions

Version 7.x-1.50 or earlier versions

[-] Vulnerability Description

The vulnerability is located within the H5PValidator::isValidPackage()

method. To skip files or to perform the next check,

Folder starting with an underscore or dot within the uploaded H5P

archive:

891. $fileName = $zip->statIndex($i)[‘name’];

892.

893. if (preg_match(‘/(^[._]|/[._])/’, $fileName) !== 0) {

894. Continue; // Do not open any files or folders that start with an. or _

894. }

The regex should suffice to stop path traversal attacks.

zipped filenames (Zip Slip Attacks), as it verifies for the

String “/.” in the filename to prevent directory traversal

attacks. Drupal running on an unprotected host is vulnerable.

Windows Server, as in this instance the attacker could provide a

Malicious h5p archives containing filenames with path traversal

Sequences such as “……”, would be able to bypass the regex checks.

You can use this to overwrite or write semi-arbitrary files.

The file system is accessed via directory traversal sequences. This could lead to

To Stored Cross-Site Scripting, (XSS), and other types of attacks.

[-] Solution:

Currently, there is no official solution.

Disclosure Timeline

[22/11/2021] – Vendor notified

[28/02/2022]- Vendor suggested a patch

28/02/2022 – Vendor was notified of the ineffective patch.

Fix suggestion

[01/03/2022] — Vendor repaired the prior patch

[30/03/2022]- A question update on the public disclosure of and publication of a

patch, no response

22/11/2022 – Official solution still not available after one year

[03/12/2022] Public Disclosure

[-] CVE Refer:

Common Vulnerabilities and Exposures Project (cve.mitre.org).

This vulnerability has been identified by CVE but no CVE ID.

[-] Credits:

Egidio Romano discovered vulnerability.

[-] Additional References

https://security.drupal.org/node/175968

[-] Original Advice:

http://karmainsecurity.com/KIS-2022-06