Path traversal bug in extractor.go at function outputpath

[eqawasm]

Impact:

The latest version of pzip/punzip v0.2.2 has a path traversal vulnerability that allows the attacker to create or write to files outside the current directory for .zip archive.

How to reproduce:

wget https://github.com/ybirader/pzip/archive/refs/tags/v0.2.2.tar.gz 
tar -xzf v0.2.2.tar.gz 
cd pzip-0.2.2/
cd cmd/punzip/ && go build

# place pocpos.zip in this directory
./punzip pocpoc.zip 

# verify attack worked
cat ../poc/testtest.txt

Root cause:

The root cause is a missing sanitization function that prevents path traversal before reaching sink function writeFile (os.OpenFile line 123) due to unsafe path join at filepath.Join.

Proposed fix:

I have created PR for a proposed fix that ensures the extraction of archive files inside the intended directory.

PoC image:
pocpoc.zip: pocpoc.zip