cross-zip Directory Traversal Vulnerability Allowing Arbitrary File Access

A directory traversal vulnerability has been identified in all versions of the cross-zip package. This issue arises from the consecutive use of the zipSync() and unzipSync() functions, which can accept arguments like __dirname. Exploitation of this vulnerability allows an attacker to access sensitive system files by strategically performing zip and unzip operations.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive system files, such as application source code or configuration files.

Reproduction

The vulnerability can be reproduced by creating a zip file that includes a sensitive system file, such as '/etc/passwd', and then unzipping it in a directory where the file can be accessed. This can be done using the cross-zip package's zipSync() and unzipSync() functions.