CVE-2022-30333

CVE-2022-30333: UnRAR Path Traversal Enables Arbitrary File Write on Linux/UNIX

AI-generated analysis based on the vulnerability data on this page.

Summary

RARLAB UnRAR before version 6.12 on Linux and UNIX platforms fails to sanitize pathnames during archive extraction. A maliciously crafted RAR archive can traverse out of the intended destination directory and write files to arbitrary locations on the filesystem. This was publicly demonstrated by overwriting ~/.ssh/authorized_keys, which can lead to remote code execution via SSH access. WinRAR and Android RAR are not affected.

Background

UnRAR is the official command-line extraction utility for RAR archives, widely deployed on Linux servers, mail gateways, and web applications that accept archive uploads. Because many platforms and services automatically unpack incoming archives to inspect contents or extract attachments, UnRAR is often exposed to untrusted input in automated workflows. The vulnerability was discovered and reported in the context of a Zimbra mail-server exploitation chain, where an unauthenticated attacker could achieve pre-authentication remote code execution by combining this flaw with other techniques.

Root Cause

The vulnerability stems from CWE-22: Path Traversal. During the extraction process, UnRAR does not adequately validate or normalize file paths within the archive. An attacker can embed directory-traversal sequences (e.g., ../../../) into filenames or directory entries inside a RAR archive. When UnRAR processes these entries, it resolves the path relative to the extraction target without sufficient boundary checks, ultimately writing files outside the intended directory.

The root cause is an insufficient input-validation layer in the pathname-handling logic specific to the Linux/UNIX build of UnRAR; the Windows and Android code paths were not affected because they rely on different filesystem APIs and path-resolution semantics.

Impact

The CVSS v3.1 vector scores this vulnerability at 7.5 (HIGH) with the following characteristics:

• Attack Vector (AV): Network — the vulnerability can be exploited remotely.
• Attack Complexity (AC): Low — no special conditions are required.
• Privileges Required (PR): None — the attacker does not need credentials.
• User Interaction (UI): None — exploitation can be fully automated.
• Scope (S): Unchanged — the vulnerable component is the only one impacted.
• Confidentiality (C): None — no direct information disclosure.
• Integrity (I): High — arbitrary files can be created or overwritten.
• Availability (A): None — no direct denial-of-service effect.

The primary risk is integrity compromise: an attacker who can cause an affected system to extract a malicious archive can plant backdoors, modify startup scripts, or overwrite authentication keys. In the Zimbra attack chain, this was escalated to full unauthenticated remote code execution.

The EPSS score of 0.98975 places this vulnerability in the top 0.08% of all CVEs by probability of exploitation, and its presence on both the CISA KEV catalog and the EU exploited-vulnerability database confirms active, in-the-wild exploitation.

Exploitation Walkthrough

Ethics caveat: This section describes the vulnerability mechanism from a defensive and analytical perspective only. No weaponized exploit code is provided. The goal is to help defenders understand attack surface and detection opportunities.

An attacker constructs a RAR archive containing a file whose internal pathname includes directory-traversal sequences pointing to a sensitive target, such as:

../../../home/targetuser/.ssh/authorized_keys

When the victim system (or an automated service) invokes an affected version of UnRAR to extract the archive, the traversal sequences are resolved against the current working directory or the specified output path. Because the vulnerable UnRAR build does not block traversal above the extraction root, the file is written to the attacker's chosen absolute path. If the attacker supplies a valid SSH public key, they gain passwordless SSH access as the targeted user.

Key prerequisites for exploitation:

1. The target system runs a vulnerable Linux/UNIX build of UnRAR.
2. The attacker can deliver a malicious RAR archive to a workflow that automatically extracts it.
3. The extraction process has sufficient filesystem permissions to write to the target path.

Affected and Patched Versions

Affected:

• RARLAB UnRAR for Linux and UNIX — all versions before 6.12
• Debian Linux 10.0 (ships vulnerable unrar packages)
• SUSE Linux Enterprise Server 12 SP5 and related SKUs (unrar < 5.6.1-4.8.1)

Not Affected:

• WinRAR (Windows)
• Android RAR

Patched:

• RARLAB UnRAR 6.12 and later for Linux/UNIX

Remediation

1. Upgrade UnRAR to version 6.12 or later on all Linux and UNIX systems. The vendor provides updated binaries at the official RARLAB download page.
2. Apply distribution patches if you rely on OS package managers:
   • Debian LTS has issued updates (see DLA-3507-1).
   • Gentoo has published GLSA 202309-04.
   • SUSE has released SUSE-SU-2022:1760-1.
3. Compensating controls (where immediate patching is not possible):
   • Sandbox archive-extraction processes inside containers or chroot jails with minimal write permissions.
   • Run extraction services under dedicated low-privilege accounts that cannot write to system directories or user home folders.
   • Validate extracted file paths programmatically before use, rejecting any entries that resolve outside the intended destination directory.
   • Consider disabling automatic extraction of RAR archives in untrusted ingestion pipelines.

Detection

• Filesystem monitoring: Alert on unexpected writes to ~/.ssh/authorized_keys, /etc/cron.d/, /etc/systemd/system/, or other sensitive paths immediately following an UnRAR process invocation.
• Process auditing: Monitor command-line invocations of unrar or unrar-nonfree, especially those executed by web-server, mail-server, or automation-service accounts.
• EDR/SIEM rules: Correlate UnRAR process events with subsequent SSH login successes from new or unknown source IPs.
• Static asset scanning: Inventory all systems running UnRAR and flag versions below 6.12.

Assessment

CVE-2022-30333 is a textbook example of how a seemingly routine utility — an archive extractor — can become a critical attack vector when exposed to untrusted input. The extremely high EPSS score (0.98975) and confirmed KEV/EU-exploited status mean that threat actors have already weaponized this flaw at scale. The Zimbra exploitation chain demonstrated that path traversal in file-processing utilities is not merely a theoretical concern; in practice it can bridge the gap from a benign file upload to full server compromise.

Key lessons:

1. Sanitize every pathname produced during archive extraction; never trust filenames embedded in third-party archive formats.
2. Assume all file-processing utilities are security-critical when they handle untrusted input; patch them with the same urgency as internet-facing daemons.

References

• http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html
• https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/
• https://lists.debian.org/debian-lts-announce/2023/08/msg00022.html
• https://security.gentoo.org/glsa/202309-04
• https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz
• https://www.rarlab.com/rar_add.htm
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30333