New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Possible vulnerability in ZIP decompression #260

Open

bfabio opened this issue Nov 13, 2023 · 0 comments

Member

bfabio commented Nov 13, 2023 •

edited

Loading

spid-saml-check/spid-validator/server/api/metadata-sp.js

Line 219 in 414e2b7

fs.createReadStream(req.file.path)

unzips the file passed in by the user, I think a simple zip bomb would DoS the entire server.

Also unzip latest release was 9 years ago and looks unmaintained.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment