sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)

Impact

Given specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. The follow is an example of a malicious entry:

+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys

This would have a potential to overwrite /root/.ssh/authorized_keys. Within sbt’s main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks - https://github.com/search?q=IO.unzip+language%3AScala&type=code&l=Scala&p=1

Patches

The problem has been patched in https://github.com/sbt/io/pull/360
sbt 1.9.7 is available with the fix.

Workarounds

A workaround might be use some other library to unzip.

References

• https://github.com/snyk/zip-slip-vulnerability
• https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31680
• https://github.com/sbt/io/issues/358