# Path traversal in filename in LINE Mac client

Path traversal in LINE Mac client's zip filename handling let a crafted .zip execute pre-installed apps, chained with Keep upload of a .terminal file for code execution.

- Payout: hidden
- Severity: high
- Program: LY Corporation
- Found by: hackerontwowheels
- Disclosed: 2020-07-31
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/727727
- Library page: https://bugbountylibrary.com/r/h1%3A727727
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone sev:high tech:payment technique:chained vuln:file-upload vuln:path-traversal

**Target:** LINE Mac desktop client zip file handling / Keep file sharing
**Root cause:** Logic error in filename parsing of received zip files allows path traversal out of the download directory; combined with `#` to truncate the extension, an arbitrary .app path is executed on open. Keep's executable blacklist omits .terminal files.
**Steps:**
1. Send victim a zip whose entry name is `..%2f..%2f..%2f..%2f..%2f..%2f..%2fApplications%2fCalculator.app#.zip`
2. Victim opens the zip in LINE Mac client; the `#` blocks the .zip extension so the path resolves to /Applications/Calculator.app and executes it
3. To gain arbitrary code execution: upload a malicious `.terminal` file to Keep (not on the executable blacklist)
4. Share the .terminal file with the victim via Keep; victim downloads it to ~/Downloads
5. Send the crafted path-traversal zip pointing at the downloaded .terminal file
6. Victim opens the zip; the .terminal executes (requires Gatekeeper disabled)
**How found:** Researchers noticed filename parsing logic in the Mac client and tested traversal payloads with `#` to neutralize the appended extension, discovering arbitrary .app execution; then probed Keep's executable blacklist to find .terminal was missing.
**Exploitation:** Attacker uploads a .terminal payload to Keep bypassing executable filtering, shares it so the victim downloads it to ~/Downloads, then sends a zip with a traversal filename (`#` truncates extension) that when opened executes the previously downloaded .terminal file, yielding code execution if Gatekeeper is off.
**Escalation:** Chained Keep upload restriction bypass (.terminal not blacklisted) with the path traversal to convert app-launch into full code execution.
**Insight:** When a client appends a fixed extension to an attacker-controlled filename, try `#` (or null/`?`) to truncate it and combine with traversal to reach arbitrary absolute paths; also enumerate file-type blacklists for unlisted executable extensions like .terminal.