Impact

The QTIWorks Engine allows users to upload QTI content packages as ZIP files.

The current ZIP handling code does not sufficiently check the paths of files contained within ZIP files, so can insert files into other locations in the filesystem if they are writable by the process running the QTIWorks Engine.

In extreme cases, this could allow anonymous users to change files in arbitrary locations in the filesystem. This is therefore a critical flaw.

In normal QTIWorks Engine deployments, the impact is somewhat reduced because the default QTIWorks configuration does not enable the public demo functionality, so ZIP files can only be uploaded by users with "instructor" privileges.

Patches

This vulnerability is fixed in version 1.0-beta15.

All users of the QTIWorks Engine should upgrade to this version.

(In general, we'd recommend that users who run their own QTIWorks Engine deployment should only allow their servlet container to write to specific filesystem locations. This reduces the impact of vulnerabilities like this.)

Workarounds

There are no workarounds. Users should upgrade to 1.0-beta15. There are no database configuration changed required when upgrading to this version.

References

Details about these Zip Slip vulnerabilities can be found in:
https://security.snyk.io/research/zip-slip-vulnerability

Many thanks to @JLLeitschuh for reporting this vulnerability.

For more information

Please open an issue to discuss this vulnerability:
https://github.com/davemckain/qtiworks/issues