Arbitrary File Write via Path Traversal in actions/artifact 2.x

This repository contains a proof-of-concept exploit for CVE-2024-42471, a file write/overwrite vulnerability in the unzip-stream library (version 0.3.1). The exploit consists of a single Python script (exploit.py) that creates a malicious ZIP archive. The archive contains a file with a directory traversal path in its name, allowing it to overwrite arbitrary files when extracted by a vulnerable unzip-stream implementation. The script requires a source file ('./poc') to include in the ZIP and specifies a target file path ('home/mcsam/pocc') to overwrite on the victim's system. The exploit also notes that Python's zipfile module must be modified to bypass arcname normalization for the PoC to work as intended. The attack vector is local, as it requires the victim to extract the crafted ZIP file using the vulnerable library. No network endpoints are present; all identified endpoints are file paths relevant to the exploit's operation.