Create admzip-path-overwrite.yaml

file/nodejs/admzip-path-overwrite.yaml

@@ -0,0 +1,22 @@
+id: admzip-path-overwrite
+
+info:
+  name: Admzip Path Overwrite
+  author: me_dheeraj (https://twitter.com/Dheerajmadhukar)
+  severity: info
+  description: Insecure ZIP archive extraction using adm-zip can result in arbitrary path over write and can result in code injection.
+  tags: file,nodejs,admzip
+
+file:
+  - extensions:
+      - all
+
+    matchers:
+      - type: regex
+        regex:
+          - "\\$X = require\\('adm-zip'\\)"
+          - "\\$ZIPENTZ\\.forEach\\(function \\$FUNC\\(\\$ENTRY, ...\\) {"
+          - "\\$FS\\.createWriteStream\\(...\\) }, ...\\)"
+          - "\\$FS\\.writeFile\\(...\\)"
+          - "\\$FS\\.writeFileSync\\(...\\) }, ...\\)"
+        condition: or