VU#293714: Arbitrary File Overwrite in Develar app-builder (zipx.Unzip) via Symlink Following on macOS (APFS)

Overview

A vulnerability in the zipx.Unzip extraction routine of Develar’s app-builder allows an attacker to overwrite arbitrary files on macOS using Apple File System (APFS). The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths.

Description

Develar’s app-builder is a command‑line build tool used heavily in the Electron ecosystem to package, sign, notarize, and produce distributable application bundles for macOS, Windows, and Linux. It is popular because it is a transitive dependency of electron-builder, one of the most widely used packaging tools for Electron apps.

The vulnerability arises from how the zipx.Unzip routine handles Unicode‑equivalent filenames and symbolic links during ZIP extraction. APFS treats certain Unicode representations as identical (e.g., ß and ss), but app-builder does not perform canonical normalization before validating output paths. As a result, an attacker can craft ZIP archives that combine Unicode normalization collisions with malicious symlinks to redirect writes outside the intended extraction directory.

The GitHub Pull Request addresses the symlink-following variant of this vulnerability (CWE‑22 and CWE‑59) by rejecting any symlink whose resolved target escapes the intended output directory and by adding O_NOFOLLOW to regular file writes. Without these protections, an attacker can craft ZIP archives containing malicious symlinks and Unicode-colliding filenames to overwrite arbitrary files on APFS-backed systems.

Impact

Exploitation of this vulnerability allows an attacker to overwrite arbitrary files on macOS systems using APFS. By combining Unicode normalization collisions with symlink‑following behavior in the zipx.Unzip routine, an attacker can craft ZIP archives that bypass path‑validation checks and redirect writes outside the intended extraction directory. This may result in loss of integrity, denial of service, or potential code execution, depending on which files are overwritten. Because APFS treats certain Unicode‑equivalent filenames as identical, the attack can evade typical sanitization logic unless canonical normalization is enforced. The vulnerability is exploitable during ZIP extraction without requiring elevated privileges.

Supply-chain Impact

Develar’s app-builder is widely used as a dependency across the ecosystem, affecting numerous downstream repositories. Several projects have already mitigated their exposure, while others may still be affected. A complete remediation requires fixing the vulnerability at its source.

Solution

Develar has not responded to several emails or to issues posted in the GitHub repository requesting contact. The reporter has developed a Pull Request to provide downstream customers with a reference fix and to enable them to analyze the vulnerable code or implement their own patches: https://github.com/develar/app-builder/pull/163

Acknowledgements

CERT/CC thanks the reporter, Tomas Illuminati, Cyber Security Researcher & Threat Intelligence Specialist, for assisting many downstream vendors and developers in mitigating this issue.

We also thank Electron-Userland for responding quickly and implementing a mitigation to protect their downstream users.

This AI-assisted vulnerability note was prepared by Laurie Tyzenhaus.