Path Traversal flaw in UnRAR can allow hacking Zimbra Mail servers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-30333 | Directory Traversal in RARLAB UnRAR (Linux/UNIX) Enables Arbitrary File Writes RARLAB's UnRAR command-line decompression tool on Linux and UNIX, in versions before 6.12, contains a directory traversal flaw (CWE-22, with symlink-based path confusion per CWE-59) that lets a crafted RAR archive write files to arbitrary filesystem locations during an extract/unpack operation. It is triggered whenever an application passes an attacker-supplied archive to unrar, most prominently Zimbra Collaboration Suite, which unpacked RAR attachments from incoming email, enabling pre-authentication attacks against webmail tracked separately as CVE-2022-41352. By planting files at chosen paths — for example writing an SSH key to ~/.ssh/authorized_keys or dropping a web shell under a web root — an attacker can escalate an arbitrary file write into code execution on the server, requiring no privileges or user interaction per the CVSS vector. Only the Linux/UNIX UnRAR utility is affected; WinRAR and RAR for Android are not. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-09 with known ransomware use, public PoCs exist, and EPSS estimates a ~99% probability of exploitation within 30 days. Do: Upgrade UnRAR to 6.12 or later on all Linux and UNIX systems and apply Debian's patched unrar package; Zimbra administrators should apply Zimbra's released security patches, which ship the fixed UnRAR. As an interim mitigation, restrict or monitor services that automatically extract RAR archives from untrusted sources, and hunt for indicators such as unexpected ~/.ssh/authorized_keys entries, planted symlinks, or web shells under web roots. Because the flaw is on CISA's KEV list with known ransomware use, treat patching as time-critical. | 7.5 | 99% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed servers (dominated by Zimbra mail servers that auto-extract RAR attachments), with the total UnRAR installed base on… |
Full article650 words · extracted from securityaffairs.com · click to collapse
Researchers discovered a new flaw in RARlab’s UnRAR utility, tracked CVE-2022-30333, that can allow to remotely hack Zimbra Webmail servers.
SonarSource researchers have discovered a new vulnerability in RARlab’s UnRAR utility, tracked as CVE-2022-30333, that can be exploited by remote attackers to execute arbitrary code on a system that relies on the binary, like Zimbra webmail servers.
Zimbra is an enterprise-ready email solution used by over 200,000 businesses, government and financial institutions.
“we discovered a 0-day vulnerability in the unrar utility, a 3rd party tool used in Zimbra. The vulnerability ultimately allows a remote attacker to execute arbitrary code on a vulnerable Zimbra instance without requiring any prior authentication or knowledge about it.” reads the post published by SonarSource researchers. “
“An attacker is able to create files outside of the target extraction directory when an application or victim user extracts an untrusted archive. If they can write to a known location, they are likely to be able to leverage it in a way leading to the execution of arbitrary commands on the system.”
The CVE-2022-30333 flaw in the unrar binary developed by RarLab is a File Write vulnerability that could be exploited by tricking victims into extracting maliciously crafted RAR archives.
The experts pointed out that In the case of Zimbra, threat actors could exploit this issue to access every email sent and received on a compromised email server. An attacker can fully compromise a server and install a backdoor and use the compromised machine as a pivot to target other systems withing the organization.
“The only requirement for this attack is that unrar is installed on the server, which is expected as it is required for RAR archive virus-scanning and spam-checking.” continues the report.
Below is the timeline for this issue:
| Date | Action |
|---|---|
| 2022-05-04 | We report the bug in unrar to RarLab. |
| 2022-05-04 | We are already in communication with Zimbra about another issue. We give them a heads up about an upcoming security patch from RarLab and send them a Proof-of-Concept exploit to verify that the issue affects Zimbra |
| 2022-05-04 | RarLab confirms the issue. |
| 2022-05-05 | RarLab sends us a patch for review. We confirm the patch is effective the same day. |
| 2022-05-06 | RarLab releases version 6.12 of the binary on their website. |
| 2022-05-07 | We send a dedicated email to Zimbra regarding this issue and send the Proof-of-Concept exploit again. |
| 2022-05-11 | We notice a flaw in our Proof-of-Concept and send Zimbra more files to help them verify the issue. |
| 2022-05-11 | We notify Debian and Ubuntu package maintainers of the security issue. |
| 2022-05-11 | Zimbra notifies us that they were able to reproduce the vulnerability. |
| 2022-05-25 | We notify Zimbra of the planned release date for this blog post. |
The issue stems from a symbolic link attack, threat actors could create a RAR archive containing a symlink that contains forward and backslashes (e.g., “..\..\..\tmp/shell”) to bypass current checks and extract it outside of the target extraction directory.
The flaw resides in a function that converts backslashes (‘\’) to forward slashes (‘/’) to RAR archives created on Windows to be extracted on Unix systems.
The attacker can exploit this flaw to write arbitrary files anywhere on the target filesystem, including writing a JSP shell into a web directory shell in Zimbra’s web directory.
“An attacker can achieve RCE impact via various means. We mentioned for example, that an attacker could write a JSP shell into a web directory. Luckily, most Zimbra instances have their services distributed across multiple servers and thus this path of exploitation is not possible on most installations. However, we have reported multiple different paths of exploitation that work on distributed installations.” concludes the report. “For this reason we recommend upgrading unrar immediately, even if your web server and mail server are not on the same physical machine.”
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Zimbra)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/132737/breaking-news/unrar-path-traversal-flaw-zimbra.html