CVE-2022-30333
RARLAB UnRAR Directory Traversal Vulnerability
Description
CVE-2022-30333 is a directory traversal vulnerability in RARLAB UnRAR on Linux and UNIX systems that allows an attacker to write to arbitrary files during an extract (unpack) operation. By crafting a malicious RAR archive with specially constructed path entries, an attacker can escape the intended extraction directory and write files to arbitrary locations on the file system. CISA has added CVE-2022-30333 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and the vulnerability is known to be used in ransomware campaigns. With an EPSS score of 92.8% (99.8th percentile), this vulnerability has an extremely high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| rarlab | unrar | < 6.12 |
| debian | debian linux | 10.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html(Exploit, Third Party Advisory, VDB Entry)
- https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/(Exploit, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2023/08/msg00022.html(Mailing List, Third Party Advisory)
- https://security.gentoo.org/glsa/202309-04(Third Party Advisory)
- https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz(Patch)
- https://www.rarlab.com/rar_add.htm(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30333(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-30333 is a path traversal vulnerability in the UnRAR extraction utility where the software fails to properly sanitize file paths contained within RAR archives during extraction. The unpack operation does not adequately neutralize directory traversal sequences in archive entries, allowing an attacker to specify paths that escape the intended extraction directory and write files to arbitrary locations on the file system.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2022-30333 is a particularly dangerous vulnerability because it can be exploited through any workflow that automatically or manually extracts RAR archives on Linux or UNIX systems. Email gateways, file sharing services, and automated processing pipelines that handle RAR files are all potential attack vectors. Successful exploitation allows the attacker to write arbitrary files to any location writable by the process running UnRAR, which can lead to remote code execution through web shell deployment, configuration file manipulation, or crontab modification. The confidentiality risk extends to any data accessible on the file system, integrity is compromised through arbitrary file writes, and availability can be disrupted through ransomware or system file corruption. The confirmed use in ransomware campaigns and the EPSS score of 92.8% (99.8th percentile) confirm extreme real-world exploitation risk.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-30333 in the wild by adding it to the Known Exploited Vulnerabilities catalog on August 9, 2022, with a remediation deadline of August 30, 2022. This vulnerability is known to be used in ransomware campaigns, significantly elevating the threat level. The EPSS score of 92.8% (99.8th percentile) indicates near-certain exploitation activity. The vulnerability was notably used to attack Zimbra email servers, where a crafted RAR archive sent via email could exploit UnRAR during automatic extraction to write a web shell to the Zimbra web root, achieving remote code execution without user interaction beyond email delivery.
Remediation
- Update UnRAR to version 6.12 or later: RARLAB addressed CVE-2022-30333 in UnRAR version 6.12, which includes proper path validation during extraction operations.
- Identify all systems using UnRAR: Audit your environment for all instances of UnRAR, including those bundled within other applications, email gateways, and automated processing pipelines. Pay special attention to Zimbra servers, which use UnRAR for attachment processing.
- Implement file extraction sandboxing: Configure automated archive extraction processes to operate within sandboxed environments with limited file system access, preventing path traversal attacks from reaching sensitive system locations.
- Add RAR file scanning at email gateways: Configure email security gateways to inspect RAR archive contents for path traversal sequences before allowing delivery, blocking archives that contain suspicious directory escape patterns.
- Monitor for unauthorized file creation: Implement file integrity monitoring on critical directories such as web roots, cron directories, and system configuration paths to detect unauthorized file writes that may indicate exploitation.
Technical Details
CVE-2022-30333 is a directory traversal vulnerability in the RARLAB UnRAR utility on Linux and UNIX systems. During the extraction of RAR archives, UnRAR processes the file path information stored in each archive entry to determine where to write the extracted files. The vulnerability exists because UnRAR does not properly sanitize these paths to prevent directory traversal sequences from escaping the intended extraction directory. By crafting a RAR archive with entries containing symbolic link manipulation or path components that resolve outside the extraction directory, an attacker can write arbitrary files to any location accessible to the user running UnRAR. The attack gained significant attention when it was demonstrated against Zimbra email servers, where the server-side UnRAR process automatically extracts email attachments for scanning. A malicious RAR attachment could write a JSP web shell directly to the Zimbra web application directory, achieving remote code execution through the automatic email processing pipeline without any user interaction.
Frequently Asked Questions
Is CVE-2022-30333 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2022-30333 and the vulnerability is known to be used in ransomware campaigns. The EPSS score of 92.8% (99.8th percentile) indicates near-certain exploitation. The vulnerability has been notably used against Zimbra email servers through crafted RAR email attachments.
What products are affected by CVE-2022-30333?
CVE-2022-30333 affects RARLAB UnRAR on Linux and UNIX systems. This includes any application or service that uses UnRAR for archive extraction, such as Zimbra email servers, file processing pipelines, and other tools that handle RAR files. UnRAR versions prior to 6.12 are vulnerable.
How do I fix CVE-2022-30333?
Update UnRAR to version 6.12 or later, which includes the fix for the directory traversal vulnerability. Audit your environment for all instances of UnRAR, including those bundled within other applications and email gateways. On Zimbra servers, ensure the system UnRAR package is updated.
How severe is CVE-2022-30333?
CVE-2022-30333 is an extremely severe vulnerability with an EPSS score of 92.8% (99.8th percentile) and confirmed use in ransomware campaigns. The directory traversal can lead to arbitrary file writes and remote code execution, particularly on email servers where RAR archives are automatically processed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.