CVE-2024-24569: Pixee Java Security Toolkit Path Traversal

CVE-2024-24569 Overview

CVE-2024-24569 is a partial path traversal vulnerability in the Pixee Java Code Security Toolkit, a set of security APIs designed to help developers secure Java code. The flaw resides in the ZipSecurity#isBelowCurrentDirectory method, which is intended to guard against ZIP-based path traversal attacks (Zip Slip). While the control blocks escapes into higher-level directories such as /etc/, it fails to prevent traversal into sibling directories. An application running under /my/app/path can be tricked into resolving paths like /my/app/path-something-else. The issue affects toolkit versions <=1.1.1 and is patched in 1.1.2.

Critical Impact
Applications relying on ZipSecurity to sanitize ZIP entry paths may allow attackers to read or write files in sibling directories, undermining the toolkit's promised traversal protection [CWE-22].

Affected Products

Pixee Java Code Security Toolkit versions <=1.1.1
Java applications using ZipSecurity#isBelowCurrentDirectory as a path-traversal guard
Downstream libraries and services bundling io.github.pixee:java-security-toolkit

Discovery Timeline

2024-02-01 - CVE-2024-24569 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24569

Vulnerability Analysis

The Pixee Java Code Security Toolkit exposes ZipSecurity as a defensive wrapper around ZipInputStream operations. Its isBelowCurrentDirectory check is used to validate that an extracted ZIP entry resolves to a path beneath the current working directory. The implementation performs a prefix comparison on string paths rather than a structural comparison using java.nio.file.Path semantics. This allows an attacker-controlled ZIP entry to resolve to a sibling directory whose absolute path shares the same prefix as the intended root. The impact is confidentiality and integrity loss limited to sibling paths, since the check still prevents traversal into unrelated higher-level directories.

Root Cause

The root cause is unsafe string-prefix matching when comparing the resolved entry path against the current directory. If the current directory is /my/app/path, any resolved path beginning with that string, such as /my/app/path-backup, satisfies the check. The patch introduces java.nio.file.Path for proper path-component comparison, ensuring that only paths whose components are truly descendants of the target directory are allowed [CWE-22].

Attack Vector

Exploitation requires a network-reachable code path that consumes attacker-supplied ZIP archives and relies on ZipSecurity for traversal protection. The attacker crafts a ZIP entry whose relative name resolves, after normalization, to a sibling directory adjacent to the application root. When the vulnerable application extracts the archive, the bypass permits file reads or writes outside the intended extraction directory but within sibling paths sharing the same prefix.

java

// Patch: introduces java.nio.file.Path for structural comparison
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.Charset;
+import java.nio.file.Path;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
// Source: https://github.com/pixee/java-security-toolkit/commit/b885b03c9cfae53d62d239037f9654d973dd54d9

text

// Version bump in build.gradle.kts confirming the fix release
 group = "io.github.pixee"
-version = "1.1.1"
+version = "1.1.2"
 description = "java-security-toolkit"
// Source: https://github.com/pixee/java-security-toolkit/commit/b885b03c9cfae53d62d239037f9654d973dd54d9

Detection Methods for CVE-2024-24569

Indicators of Compromise

ZIP archives containing entries whose normalized paths begin with the application root prefix but resolve outside it, such as ../path-backup/config.
File system writes or reads in sibling directories adjacent to the application's working directory following ZIP extraction events.
Presence of io.github.pixee:java-security-toolkit version 1.1.1 or lower in application dependency manifests.

Detection Strategies

Perform Software Composition Analysis (SCA) across build artifacts and container images to enumerate applications shipping vulnerable versions of the toolkit.
Add static analysis rules to flag call sites of ZipSecurity.isBelowCurrentDirectory in codebases pinned to versions <=1.1.1.
Instrument JVM applications to log the resolved absolute path of every ZIP entry prior to extraction and alert on paths outside the intended extraction root.

Monitoring Recommendations

Monitor file creation events in directories that are siblings of Java service working directories using endpoint telemetry.
Alert on unexpected process access to configuration or credential files located in sibling paths to running Java processes.
Track dependency updates through SBOM ingestion pipelines to confirm upgrade to java-security-toolkit1.1.2 or later.

How to Mitigate CVE-2024-24569

Immediate Actions Required

Upgrade io.github.pixee:java-security-toolkit to version 1.1.2 or later across all Maven and Gradle projects.
Audit application code for direct or indirect use of ZipSecurity#isBelowCurrentDirectory and validate that the fix is loaded at runtime.
Rebuild and redeploy affected services, then invalidate any cached artifacts that may still reference the vulnerable dependency.

Patch Information

The fix is delivered in commit b885b03 and released as version 1.1.2. The patch replaces string-prefix comparison with java.nio.file.Path-based checks. Full details are documented in the Pixee GHSA-qh4g-4m4w-jgv2 advisory and the original ZipSecurity source.

Workarounds

Replace direct calls to ZipSecurity#isBelowCurrentDirectory with a custom validator that uses Path.toAbsolutePath().normalize().startsWith(rootPath) where rootPath is also normalized.
Extract ZIP archives inside a dedicated temporary directory with restrictive filesystem permissions to contain any bypass.
Reject any ZIP entry whose name contains .. segments or absolute path prefixes before invoking extraction logic.

bash

# Gradle: pin the fixed version
implementation("io.github.pixee:java-security-toolkit:1.1.2")

# Maven: pin the fixed version
# <dependency>
#   <groupId>io.github.pixee</groupId>
#   <artifactId>java-security-toolkit</artifactId>
#   <version>1.1.2</version>
# </dependency>