How would Apache or Compressed HTTP react to a zip bomb?

Question

inspired by Compress a 1GB file into 200_MB? and the related comments:

Many webservers today use a zipped HTTP Version (Gzip afaik).

How would Apache or any other server react to a zip bomb? Since the files are compressed, one could just send a prepared file and the target server would extract it to several GB/TB? Or is this in some way prevented? And when, how?

I hope I will not see the Internet crash due to this question ;-)

Answer 1

You can be absolutely certain that there are people out there who spend a significant amount of time trying to crash Apache web servers externally, just as you can be sure that the Apache Software Foundation spends a significant amount of time testing their software to ensure that this type of attack will not succeed.

To specifically address your question; Apache uses mod_deflate to compress and decompress data sent and received. So, the target here is not Apache but the module used for handling compressed files.

Given that zip bombs are a well known vector of attack, and that it is possible to craft a request containing a maliciously formed zip object, this type of attack would fail.

You can be certain that the day someone finds a way to attack in this manner the problem will be identified and patched in a very short period of time.

Some applications have specific detection routines to detect and handle zip bombs.