New UnRAR Vulnerability Could Lead to Zimbra Webmail Hack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-30333 | Directory Traversal in RARLAB UnRAR (Linux/UNIX) Enables Arbitrary File Writes RARLAB's UnRAR command-line decompression tool on Linux and UNIX, in versions before 6.12, contains a directory traversal flaw (CWE-22, with symlink-based path confusion per CWE-59) that lets a crafted RAR archive write files to arbitrary filesystem locations during an extract/unpack operation. It is triggered whenever an application passes an attacker-supplied archive to unrar, most prominently Zimbra Collaboration Suite, which unpacked RAR attachments from incoming email, enabling pre-authentication attacks against webmail tracked separately as CVE-2022-41352. By planting files at chosen paths — for example writing an SSH key to ~/.ssh/authorized_keys or dropping a web shell under a web root — an attacker can escalate an arbitrary file write into code execution on the server, requiring no privileges or user interaction per the CVSS vector. Only the Linux/UNIX UnRAR utility is affected; WinRAR and RAR for Android are not. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-09 with known ransomware use, public PoCs exist, and EPSS estimates a ~99% probability of exploitation within 30 days. Do: Upgrade UnRAR to 6.12 or later on all Linux and UNIX systems and apply Debian's patched unrar package; Zimbra administrators should apply Zimbra's released security patches, which ship the fixed UnRAR. As an interim mitigation, restrict or monitor services that automatically extract RAR archives from untrusted sources, and hunt for indicators such as unexpected ~/.ssh/authorized_keys entries, planted symlinks, or web shells under web roots. Because the flaw is on CISA's KEV list with known ransomware use, treat patching as time-critical. | 7.5 | 99% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed servers (dominated by Zimbra mail servers that auto-extract RAR attachments), with the total UnRAR installed base on… |
Full article324 words · extracted from infosecurity-magazine.com · click to collapse
A new flaw has been discovered in RARlab’s UnRAR utility that could be exploited to steal emails from individual Zimbra mail user accounts.
The path traversal vulnerability, found in the Unix versions of UnRAR, has been assigned CVE-2022-30333 and a base score of 7.5 in the Common Vulnerability Scoring System (CVSS).
For context, Zimbra is an enterprise email solution used by over 200,000 businesses, government and financial institutions.
Security researchers from Sonar were reportedly the first to discover the UnRAR bug and released an advisory about it on Tuesday.
“We discovered a 0-day vulnerability in the UnRAR utility, a 3rd party tool used in Zimbra,” reads the document.
The flaw would allow an attacker to create files outside the target extraction directory when an application or victim user extracts an untrusted archive.
“If they can write to a known location, they are likely to be able to leverage it in a way leading to the execution of arbitrary commands on the system,” wrote Sonar.
According to the advisory, successful exploitation would give attackers access to all emails sent and received on a compromised email server.
“They can silently backdoor login functionalities and steal the credentials of an organization’s users. With this access, it is likely that they can escalate their access to even more sensitive, internal services of an organization.”
The only requirement for this attack is that UnRAR was installed on the server, which Sonar said would be likely as it is required for RAR archive virus scanning and spam-checking.
Sonar reportedly warned RarLab about the flaw on May 04, and the company released a patch on May 06 as part of version 6.12. Other versions of the software, including those for Windows and Android operating systems, are not impacted by the vulnerability.
The fix comes almost a year after Zimbra was mentioned in a joint US and UK government report identifying the company as a possible target of Russian spies.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/unrar-vulnerability-lead-zimbra/