ZIP Bombs and large ZIP files being allowed in file uploads

[tanmaypardeshi]

ZIP Bombs and Large ZIP files are being allowed to be uploaded on the portal

• ASVS V12.1 File Upload Requirements is being violated in this bug.
• To be specific, it is ASVS 12.1.2 : Verify that files are checked for "zip bombs" - small input files that decompress into huge files thus exhausting file storage limits.
• This affects CWE 409 - Improper handling of highly compressed data(data amplification)

To Reproduce

Steps to reproduce the behavior:

1. Launch the OpenEMR application.
2. Launch the OpenEMR application and sign in using the admin credentials ([Username: admin, Password: pass] by default).
3. Go to the site https://theaviary.me/Zip-Bomb/42.html and download the zip file under the old version. This is because the new version requires a password before unzipping.
4. Once the file has been downloaded, go back to the OpenEMR portal where you had logged the admin in using the credentials.
5. At the top of the page in the navigation bar, go to Admin->Document Templates->Documents. This will take you to the “Document Template Management" Page
6. Upload the downloaded zip file in step c under the “Upload a Template” option on the “Document Template Management" page.

Expected behavior

1. The file should not be allowed to be uploaded because it is a zip bomb and it should be checked and rejected during the upload itself

Client configuration

• Browser: Chrome 124.0.6367.79 (Official Build) (arm64)
• OpenEMR version:
• Operating system: MacOS/Linux/Windows