Zip Slip Path Traversal in EDDI Backup Import

How the attack works

The attacker builds a ZIP archive where entry names contain '../' sequences, an absolute path, or a Windows drive letter instead of a normal relative filename. This archive is uploaded via a POST or PUT request to the /backup/import endpoint, either directly as the request body or as a multipart file upload. When E.D.D.I extracts the archive, it writes files to the paths named inside the ZIP rather than confining them to the backup directory, allowing the attacker to overwrite existing JAR, WAR, class, or shared-library files that the application later loads and executes. The detection also looks for the archive being built in the first place — a command-line tool creating a zip/jar/7z/tar file with traversal entries targeting these executable file types, or a curl command uploading such a file to the import endpoint.

Netzilo detection

Why it matters

Successful exploitation lets an attacker overwrite application code files and achieve remote code execution in the context of the E.D.D.I server, potentially giving full control of the host running the middleware.

What you can do

• →Upgrade E.D.D.I to version 5.5.0 or later, which fixes this vulnerability.
• →Restrict network access to the /backup/import endpoint to trusted administrators only.
• →Review backup archives for entry names containing '../', absolute paths, or drive letters before allowing import.
• →Monitor for unexpected writes to application JAR, WAR, class, or .so files outside the normal deployment process.

Known benign look-alikes

• Authorised penetration tests or vulnerability scanners uploading a deliberate Zip Slip proof-of-concept archive against an internal E.D.D.I instance.
• A legitimate E.D.D.I backup produced by a non-conformant archiver that stored entry names with parent-directory components (rare; most zip implementations strip leading ../ and / with a warning).
• Build or release tooling that packages an archive using two or more upward relative path segments to reach a JAR under a sibling module directory (branch 3 only; requires an archive tool, >=2 traversals and a binary artefact extension on the same command line).
• Security regression suites in CI that replay an archived malicious sample through the import endpoint.

References

• https://cwe.mitre.org/data/definitions/22.html
• https://attack.mitre.org/techniques/T1190/
• https://attack.mitre.org/techniques/T1574/