My ZIP isn't your ZIP: Identifying and Exploiting Semantic Gaps Between ZIP
summary
Built a differential fuzzer called ZipDiff differential fuzzer and fuzzed 50 ZIP parsers across 19 languages, finding that out of 1,225 parser pairs only four behave identically. The study catalogs 14 ambiguity types (10 previously unknown), demonstrates five real-world exploits—bypassing Gmail and other email gateways, spoofing Office content, impersonating VS Code extensions, and tampering signed nested JARs to bypass Spring Boot signature checks—and proposes seven mitigations; vendors issue bounties and CVEs.
AI-written summary · about
chapters (13)
- 0:00ZIP semantic gaps
- 1:36ZIP parsing inconsistencies
- 2:20SID div differential fuzzer
- 3:27Evaluation results
- 4:34Parsing ambiguities
- 5:17Bypassing secure email gateways
- 6:42ZIP in common file formats
- 7:25Exploiting office parsers
- 8:52Forging digital signatures
- 9:15VS Code extension attacks
- 10:38Responsible disclosure
- 11:00Key contributions
- 11:42Conclusion
related talks
26mExposing Hidden Exploitable Behaviors In Programming Languages Using Differential Fuzzing
40mAnalysis of and Lessons from the Xz-Utils Vulnerability – What Mig...
39mFuzzing: Finding Your Own Bugs and 0days!
44mHack Yourself: Intro to pentesting with ZAP
53mThree Colours of Fuzzing: Reflections and Open Challenges
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
20mProtocol Prying: Systematic Vulnerability Research in the AirDrop and Android Quick...
39m"Inter-application" vulnerabilities - hunting for bugs in..."