# Is logstash vulnerable to zip-slip?

**URL:** <https://discuss.elastic.co/t/is-logstash-vulnerable-to-zip-slip/144333>\
**Category:** Logstash\
**Created:** [August 14, 2018, 11:04am UTC](https://discuss.elastic.co/t/is-logstash-vulnerable-to-zip-slip/144333 "2018-08-14T11:04:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![electrofelix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/electrofelix/32/34435_2.png) [@electrofelix](https://discuss.elastic.co/u/electrofelix)\
**Post date:** [August 14, 2018, 11:04am UTC](https://discuss.elastic.co/t/is-logstash-vulnerable-to-zip-slip/144333/1 "2018-08-14T11:04:59Z")

</div>

Hi,

Similar to a question I asked in the Kibana forum ([Is the plugin install exposed to zip-slip?](https://discuss.elastic.co/t/is-the-plugin-install-exposed-to-zip-slip/144199?u=electrofelix)) due to some requests by the local security team, looking into whether some of the software we use is exposed to zip-slip.

Digging around in the logstash codebase on github I spotted [https://github.com/elastic/logstash/blob/fdda39964d4f5ff40fd4058c1a2faf30f366df2f/lib/bootstrap/util/compress.rb#L21-L30](https://github.com/elastic/logstash/blob/fdda39964d4f5ff40fd4058c1a2faf30f366df2f/lib/bootstrap/util/compress.rb#L21-L30) which looks like it will extract files without checking if there is any leading '..' components in the path. Similarly [https://github.com/elastic/logstash/blob/fdda39964d4f5ff40fd4058c1a2faf30f366df2f/lib/bootstrap/util/compress.rb#L55-L72](https://github.com/elastic/logstash/blob/fdda39964d4f5ff40fd4058c1a2faf30f366df2f/lib/bootstrap/util/compress.rb#L55-L72) does the same for tarfiles.

Checking the ruby stdlib I don't see anything ignoring files in TarReader if the path contains '..', so presumably it is up to application usage to perform such checking.

Looking at where this is used, [https://github.com/elastic/logstash/search?p=2&q=LogStash%3A%3AUtil%3A%3AZip&unscoped\_q=LogStash%3A%3AUtil%3A%3AZip](https://github.com/elastic/logstash/search?p=2&q=LogStash%3A%3AUtil%3A%3AZip&unscoped_q=LogStash%3A%3AUtil%3A%3AZip), it does appear to be only used by the plugin extraction and so should mean that this is only vulnerable if an admin is persuaded to install a compromised plugin.

It would be nice to confirm whether my understanding is correct, and that this is the only place that is vulnerable?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2018, 11:05am UTC](https://discuss.elastic.co/t/is-logstash-vulnerable-to-zip-slip/144333/2 "2018-09-11T11:05:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.