GHSA-c656-jcx2-7pqj
zrok copy writes attacker-controlled WebDAV paths outside the destination root
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/openziti/zrok/v2 | < 2.0.3 | 2.0.3 |
| Go | github.com/openziti/zrok | >= 0.4.23, <= 1.1.11 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
## Summary
Alice runs `zrok2 copy` from a WebDAV or zrok drive controlled by Bob into a local filesystem target. Bob returns a DAV `href` such as `/../outside.txt`. The sync pipeline stores that path in the source inventory and passes it to `FilesystemTarget.WriteStream`, which joins it with the target root and creates the file outside Alice's selected directory.
### Impact
Users given access to a zrok share may be able to traverse the directory tree arbitrarily with the sharing users credentials, allowing for sensitive information to be overwritten.
References
External links from the advisory. They lead to third-party sites.