CVE-2022-24615: Zip4j Library DOS Vulnerability

CVE-2022-24615 Overview

CVE-2022-24615 is a Denial of Service vulnerability affecting the zip4j library up to version 2.10.0. The library can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This vulnerability could be exploited to mount a denial of service attack against services that use the zip4j library for ZIP file processing.

Critical Impact

Services using zip4j for ZIP file handling are vulnerable to application crashes when processing maliciously crafted ZIP files, potentially causing service disruption.

Affected Products

• zip4j_project zip4j versions up to 2.10.0

Discovery Timeline

• 2022-02-24 - CVE CVE-2022-24615 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24615

Vulnerability Analysis

This vulnerability is classified under CWE-755 (Improper Handling of Exceptional Conditions). The zip4j library fails to properly handle exceptional conditions when parsing malformed ZIP files. When a specially crafted ZIP archive is processed, the library throws uncaught exceptions that propagate up the call stack, causing the consuming application to crash unexpectedly.

The vulnerability requires local access and user interaction, meaning an attacker would need to convince a user or automated system to process a malicious ZIP file. While the attack does not compromise confidentiality or integrity, it can completely disrupt the availability of services relying on zip4j for archive handling.

Root Cause

The root cause of this vulnerability lies in improper exception handling within the ZIP file parsing routines. When the library encounters unexpected or malformed data structures within a ZIP archive, it fails to gracefully handle these error conditions. Instead of catching and managing these exceptions internally, the library allows them to propagate as uncaught exceptions, leading to application termination.

Attack Vector

The attack vector requires an attacker to craft a malicious ZIP file designed to trigger the improper exception handling. This file must then be processed by an application using the vulnerable zip4j library. Attack scenarios include:

1. Uploading a malicious ZIP file to a web service that processes archives
2. Sending a crafted ZIP attachment via email to be processed by an automated system
3. Placing a malicious ZIP file in a directory monitored by a file processing service

The vulnerability exploitation does not require authentication or special privileges, only that the target system attempts to parse the malicious archive using the affected library version.

Detection Methods for CVE-2022-24615

Indicators of Compromise

• Unexpected application crashes or service restarts when processing ZIP files
• Application logs showing uncaught exceptions originating from zip4j library classes
• Repeated failed ZIP processing attempts followed by service unavailability
• Stack traces containing zip4j parsing methods in error logs

Detection Strategies

• Monitor application logs for uncaught exception patterns related to ZIP file processing
• Implement application-level monitoring to detect sudden process terminations
• Set up alerting for crash loops in services that handle ZIP archives
• Audit dependency manifests to identify applications using vulnerable zip4j versions

Monitoring Recommendations

• Configure crash dump collection for Java applications using zip4j to capture exception details
• Implement health checks that verify ZIP processing services remain operational
• Monitor file upload endpoints for patterns of malformed ZIP file submissions
• Enable verbose logging for archive processing operations during investigation periods

How to Mitigate CVE-2022-24615

Immediate Actions Required

• Identify all applications in your environment using the zip4j library
• Verify the version of zip4j in use and confirm if it is version 2.10.0 or earlier
• Prioritize patching for internet-facing services that accept ZIP file uploads
• Implement input validation to reject obviously malformed ZIP files before processing

Patch Information

Update the zip4j library to a patched version that properly handles exceptional conditions during ZIP file parsing. Review the GitHub Issue Discussion #377 and GitHub Issue Discussion #418 for detailed information about the fix and recommended versions.

Workarounds

• Wrap zip4j parsing operations in try-catch blocks to prevent uncaught exceptions from crashing the application
• Implement a watchdog process to automatically restart services if crashes occur
• Add file size and structure validation before passing ZIP files to the library
• Consider implementing request rate limiting on endpoints that process ZIP files to reduce DoS impact

# Configuration example
# Check your Maven dependencies for vulnerable zip4j versions
mvn dependency:tree | grep zip4j

# Update pom.xml to use a patched version
# Replace the existing zip4j dependency with:
# <dependency>
#     <groupId>net.lingala.zip4j</groupId>
#     <artifactId>zip4j</artifactId>
#     <version>[LATEST_PATCHED_VERSION]</version>
# </dependency>

# Verify the update
mvn dependency:tree | grep zip4j