Target path normalization fixed

2019-04-15 16:35:15 -05:00 · 2019-04-15 16:35:15 -05:00 · cf7096f8ba
parent 04dcd8a1f9
commit cf7096f8ba
1 changed files with 1 additions and 1 deletions
--- a/lib/msf/core/db_manager/import/metasploit_framework/zip.rb
+++ b/lib/msf/core/db_manager/import/metasploit_framework/zip.rb
@ -195,7 +195,7 @@ module Msf::DBManager::Import::MetasploitFramework::Zip

    data.entries.each do |e|
      # normalize entry name to an absolute path
-      target = File.expand_path(@import_filedata[:zip_tmp] + e.name, '/').to_s
+      target = File.expand_path(File.join(@import_filedata[:zip_tmp], e.name), '/').to_s

      # skip if the target would be extracted outside of the zip
      # tmp dir to mitigate any directory traversal attacks