Earlier in this curriculum you saw path traversal on the read side: smuggling ../ into a filename so the server reads a file outside the directory it intended. This lesson covers the write side of the same idea.
When an application accepts an uploaded archive — a .zip, .tar, .tar.gz, or .jar — and unpacks it on the server, the archive becomes a file-write primitive. Each entry in the archive carries a name and a blob of bytes, and a naive extractor writes the bytes to a path built from the name. The catch: the entry name is just a string the attacker chose when they built the archive, and nothing in the format stops it from containing ...
That class of bug is called Zip Slip. An attacker crafts an archive whose entry is named something like ../../../../var/www/html/shell.php, and a vulnerable extractor walks back out of the upload directory and writes the file wherever the .. sequence points.
Prerequisites: path-traversal-file-access for read-side traversal, ssrf-file-upload for the complaint-upload foothold, and input-validation-output-encoding for the validation/containment distinction. Use the bundled NovaCart application instance or another target you are explicitly authorized to test.
In this lesson you will:
- Understand why writing a file is more dangerous than reading one, and how Zip Slip relates to ordinary path traversal.
- Locate NovaCart's complaint upload and confirm it accepts archives, the foothold for the Arbitrary File Write challenge.
- Recognize the shape of a malicious entry name and submit one.
- Reason about why validating the archive does not protect the extracted contents, and where the durable fix has to sit.
Estimated time: 10 to 15 minutes.
When you are ready, send the Continue signal.