iceScrum Zip Slip Vulnerability in Project Import Component Allowing Arbitrary Code Execution

A Zip Slip vulnerability has been identified in the project import feature of iceScrum version 7.54 Pro On-prem. This vulnerability allows attackers to execute arbitrary code by uploading a specially crafted Zip file. The issue arises because the application does not properly sanitize file paths when extracting user-supplied project archives, such as ZIP files. Exploitation of this vulnerability could lead to writing arbitrary files on the server filesystem, with the potential for remote code execution, configuration tampering, service disruption, or data exfiltration.

Impact

Exploitation of this vulnerability could result in arbitrary code execution on the server.

Remediation

Users should apply security patches or disable the import feature until the vulnerability is patched.