Zip Slip in Aspnet with Dynamodb

Zip Slip is a path traversal vulnerability that occurs when an archive (for example a ZIP file) is extracted without sanitizing member paths. In an ASP.NET application that stores or processes user-supplied archives and interacts with Amazon DynamoDB, the risk expands across storage, metadata handling, and downstream data retrieval.

Consider an endpoint that accepts a ZIP upload, extracts it to a temporary directory, and then writes extracted file metadata (such as original filename, size, and a user-supplied key) into a DynamoDB table. If the ZIP contains entries like ../../../etc/passwd, a malicious archive can traverse outside the intended extraction root. When the application later uses the extracted path or the user-supplied key to construct a DynamoDB key (partition key/sort key), it may inadvertently expose or overwrite items that belong to other users or system data.

DynamoDB does not perform filesystem operations, so the traversal happens in the local extraction logic; however, the impact is realized when crafted keys or object references are stored in DynamoDB. For example, an attacker could cause the application to write an item with a key that maps to another user’s data, enabling unauthorized reads or writes if authorization checks are incomplete. In addition, crafted filenames can lead to inconsistent states when the application uses DynamoDB conditional writes or versioning, because the item keys or attribute values may not match the expected application model.

Because middleBrick scans the unauthenticated attack surface, it can detect unsafe extraction patterns and insecure usage of DynamoDB keys in API request surfaces. It checks inputs such as archive handling routines and parameter construction that feeds into DynamoDB operations, identifying issues like missing path normalization and missing authorization on key formation. Findings include guidance to validate and sanitize archive entries and to enforce strict key construction that isolates tenant or user context.

To mitigate Zip Slip when ASP.NET interacts with DynamoDB, focus on three areas: secure archive extraction, strict key construction, and safe DynamoDB client usage. Below are concrete, realistic examples using the AWS SDK for .NET.

1. Secure ZIP extraction with path validation

Always resolve and validate each entry path against a defined extraction root. This prevents directory traversal regardless of the archive content.

using System.IO.Compression;

public static void ExtractZipSafe(string zipPath, string destinationFolder)
{
    using var archive = ZipFile.OpenRead(zipPath);
    foreach (var entry in archive.Entries)
    {
        var resolvedPath = Path.GetFullPath(Path.Combine(destinationFolder, entry.FullName));
        if (!resolvedPath.StartsWith(Path.GetFullPath(destinationFolder), StringComparison.Ordinal))
        {
            throw new SecurityException("Invalid path in archive: " + entry.FullName);
        }
        entry.ExtractToFile(resolvedPath, overwrite: true);
    }
}

2. Safe DynamoDB key construction

Do not directly use extracted or user-controlled values as DynamoDB keys. Derive keys using a tenant or user scope and a stable identifier, and avoid concatenating raw filenames into keys or key attribute values.

using Amazon.DynamoDBv2.DataModel;

public class FileRecord
{
    [DynamoDBHashKey]
    public string UserId { get; set; }
    [DynamoDBRangeKey]
    public string FileId { get; set; }
    public string OriginalName { get; set; }
    public long Size { get; set; }
}

public static string BuildFileId(Guid rawFileId)
{
    // Do not use raw filename; use a GUID or other safe identifier
    return rawFileId.ToString();
}

// Usage when writing to DynamoDB:
var record = new FileRecord
{
    UserId = "tenant123_user456",
    FileId = BuildFileId(Guid.NewGuid()),
    OriginalName = SafeFileName(originalName),
    Size = new FileInfo(filePath).Length
};

3. Parameterized writes and conditional checks

Use DynamoDBContext’s SaveAsync and conditional expressions to avoid accidental overwrites that could be abused via malicious keys. Combine this with authorization checks that verify ownership on every request.

var config = new DynamoDBOperationConfig
{
    ConditionalOperator = ConditionOperator.Null
};
await context.SaveAsync(record, config);

middleBrick’s checks can validate that your extraction logic normalizes paths and that key-building routines do not expose directory traversal vectors. Its findings map to OWASP API Top 10:2023 A05:2021 (Broken Function Level Authorization) and A03:2021 (Injection) when malformed inputs affect DynamoDB key construction.