CyberRota Analysis
AI-GeneratedThe adm-zip library versions prior to 0.5.18 are vulnerable to a denial of service attack due to improper handling of the uncompressed size header in ZIP files, allowing an attacker to craft a small ZIP file that requests an excessive amount of memory allocation. This vulnerability can lead to process crashes in any application that utilizes adm-zip to handle untrusted ZIP files, making it critical for developers and organizations that rely on this library to prioritize immediate updates. All methods related to file extraction and reading are affected, increasing the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.