CVE-2022-30333

Executive Summary

CVE-2022-30333 is a directory traversal vulnerability in RARLAB UnRAR versions prior to 6.12 affecting Linux and UNIX platforms. The flaw allows a remote, unauthenticated attacker to write arbitrary files to arbitrary locations on the filesystem during extraction of a crafted RAR archive, due to insufficient sanitization of file paths within the archive. Successful exploitation can lead to full system compromise, most notably by overwriting the ~/.ssh/authorized_keys file of the targeted user to enable persistent SSH access without authentication. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with a mandatory remediation deadline of 2022-08-30, and the EPSS score of 0.99107 indicates active exploitation in the wild.

Technical Analysis

The vulnerability resides in the path-handling logic of RARLAB UnRAR for Linux and UNIX, versions prior to 6.12. RAR archives store file entry names as strings. During extraction, the CmdExtract function (in extract.cpp) passes these names to filesystem operations without properly validating whether the resolved path remains within the extraction target directory.

The core flaw is a path traversal (CWE-22) in the archive extraction function. When the UnRAR utility processes a crafted archive containing file entries with paths such as ../../../../home/victim/.ssh/authorized_keys, it does not adequately resolve or normalize the path before writing the file. The code checks for the presence of .. in the filename but only performs a superficial check that can be bypassed using:

1. Backslash encoding — On UNIX, the backslash character (\) is a valid filename character, but the traversal check may treat it as a path separator (as on Windows), allowing ..\..\..\ sequences to bypass the filter.
2. Multiple leading slashes — Using sequences like ////../../ can bypass naive prefix checks.
3. Unicode/alternate separators — Certain Unicode characters or byte sequences that map to / after normalization can bypass path validation.
4. Symlink following — If a previously extracted file in the archive creates a symlink within the extraction directory, subsequent files can traverse through the symlink to write outside the intended directory.

The attack surface is any system or service that automatically extracts RAR archives using UnRAR. This includes:

• Web-based file upload services that process .rar files on the backend.
• Email gateways that auto-extract attachments for scanning.
• Backup/restore scripts that process archives.
• FTP/sFTP drop directories with auto-extraction jobs.
• Package managers or update tools that pull and extract RAR archives.

A crafted archive is a single .rar file. When UnRAR processes it, the traversal occurs silently — the user or service sees a normal extraction, but files are written to attacker-controlled paths outside the target directory. The impact is integrity compromise (CVSS I:H) with no confidentiality impact (C:N) and no availability impact (A:N).

The vulnerability is not remotely exploitable on its own — an attacker must deliver the malicious archive and trigger extraction. However, the CVSS vector reflects AV:N because delivery methods (email, web upload, URL download) are network-based, and no user interaction is required beyond normal extraction operations.

Exploitation Scenarios

Scenario 1: SSH Authorized Keys Backdoor

Target: A Linux server with a web application that allows authenticated users to upload .rar files (e.g., a document management system) and automatically extracts them.

Pre-requisites: The web application must execute UnRAR with the privileges of a system user (e.g., www-data or a per-user account) and the extraction directory must be writable.

Step 1 — Reconnaissance: The attacker identifies the HTTP file upload endpoint and confirms that uploaded .rar files are automatically extracted. This can be determined by uploading a benign test archive and observing response behavior (e.g., returned file listing, extraction status messages).

Step 2 — Archive Creation: The attacker creates a RAR archive on a local machine using a tool like rar or 7z with the following structure:

archive.rar
└── ../../../../../home/target_user/.ssh/authorized_keys

The file content is a valid SSH public key matching the attacker's private key. The relative path contains enough .. segments to traverse from the extraction directory (e.g., /var/www/uploads/ ) to the root / and then into the target user's home directory.

Step 3 — Bypass the Traversal Check: To bypass UnRAR's path validation, the attacker encodes the .. sequence using backslashes: ..\..\..\..\..\home\target_user\.ssh\authorized_keys. On Linux, backslashes are valid filename characters and are not treated as separators by the kernel, but if the UnRAR code's traversal check is Windows-centric, it may misinterpret them as separators and fail to detect the traversal. Alternatively, the attacker can use multiple leading slashes (////../../...) if the check only verifies the first character.

Step 4 — Upload and Trigger: The attacker uploads the crafted archive via the web form. The server-side script calls unrar x archive.rar /var/www/uploads/. UnRAR processes the archive, resolves the path with traversal components, and writes the content to /home/target_user/.ssh/authorized_keys.

Step 5 — SSH Access and Persistence: The attacker immediately attempts ssh target_user@server using the corresponding private key. If the target user has sshd running, access is granted without a password. Attackers can also create additional backdoor users by writing to /etc/passwd or add cron jobs by writing to /etc/cron.d/.

Post-Exploitation Impact: The attacker has persistent, unauthenticated SSH access to the system. From here, they can escalate privileges (if not already root), pivot to other hosts, exfiltrate data, or deploy ransomware. The integrity of the system is fully compromised.

Scenario 2: Web Application Config Overwrite

Target: A Linux server running a Java/PHP web application that extracts .rar archives uploaded by users. The UnRAR binary runs as the web application user.

Step 1 — Reconnaissance: The attacker identifies a file-sharing or data-processing web application with RAR extraction support.

Step 2 — Archive Crafting: The attacker crafts an archive containing a file entry:

../../../../var/www/html/config.php

The payload content is malicious PHP code (e.g., a webshell or a configuration override that disables security filters).

Step 3 — Upload: The attacker uploads the archive through the web interface. The application extracts it to /tmp/uploads/client_1234/. The traversal path ../../../../var/www/html/config.php resolves from the extraction subdirectory to the web root.

Step 4 — Activation: The attacker navigates to http://server/config.php or any page that includes the overwritten config, executing the injected PHP code. This results in remote code execution under the web server user context.

Step 5 — Lateral Movement: The attacker fingers the web server for other writable paths, drops additional tools, and attempts privilege escalation to root.

Scenario 3: Automated Backup Server Compromise

Target: A backup server that polls a directory for .rar archives (e.g., via cron) and auto-extracts them for indexing.

Step 1 — Reconnaissance: The attacker identifies the backup server's ingestion endpoint (e.g., an anonymous FTP upload directory).

Step 2 — Crafting the Archive: The attacker crafts an archive with a path targeting the root's authorized_keys or a cron job:

../../../../root/.ssh/authorized_keys

Step 3 — Delivery: The attacker uploads the archive via FTP. The backup job's cron script extracts it using unrar e -o+ /incoming/archive.rar /data/backups/.

Step 4 — Root Access: Because the backup script runs as root, the crafted path writes to /root/.ssh/authorized_keys (assuming the extraction runs in a directory from which ../../../../ reaches root). The attacker gains root SSH access.

Step 5 — Full Domain Compromise: The backup server often has credentials for other systems. The attacker harvests backup credentials and moves laterally.

Impact Assessment

CVSS Score: 7.5 (High) — The vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N indicates:

• Attack Vector: Network (N) — The archive can be delivered over any network channel.
• Attack Complexity: Low (L) — No special conditions or race windows are required.
• Privileges Required: None (N) — An unauthenticated attacker can craft and deliver the archive.
• User Interaction: None (N) — Extraction is automated or performed by the victim without malicious intent.
• Scope: Unchanged (U) — The impact is confined to the affected component, but the affected component is the OS-level filesystem.
• Integrity Impact: High (H) — Arbitrary file write with no restrictions on content or location.
• Confidentiality/Availability Impact: None (N) — The vulnerability itself does not leak data or crash services.

Business Impact:

• Systems Affected: Any Linux/UNIX server or endpoint where UnRAR < 6.12 is used, either manually or via automation. This includes web servers, FTP servers, email gateways, backup systems, and developer workstations.
• Blast Radius: Full filesystem write access under the privileges of the user running UnRAR. If UnRAR is run with elevated privileges (e.g., as root in backup scripts), the attacker gains root-level file write, which is equivalent to full system compromise.
• Attacker ROI: The vulnerability is trivially exploitable (no authentication, low complexity), and the impact (arbitrary file write) can be directly chained into RCE via authorized_keys overwrite or webshell injection. The high EPSS score (0.99107) confirms attackers are actively using this.

Detection Guidance

Sigma Rule

title: RARLAB UnRAR Directory Traversal Exploitation
id: 5b38f4a1-2a9e-4b6d-9f3a-8c2b1d5f7a90
status: experimental
description: Detects extraction of RAR archives containing path traversal sequences targeting sensitive files
author: Valtersit Threat Intelligence
date: 2024/01/15
tags:
    - attack.initial-access
    - attack.t1203
    - cve.2022.30333
    - cwe.22
logsource:
    category: process_creation
    product: linux
detection:
    selection_unrar:
        Image|endswith:
            - '/unrar'
            - '/unrar-nonfree'
            - '/rar'
        CommandLine|contains:
            - 'x'
            - 'e'
            - 'p'
    selection_traversal:
        CommandLine|contains:
            - '.ssh'
            - 'authorized_keys'
            - 'cron.d'
            - 'systemd'
            - 'etc/passwd'
            - 'etc/shadow'
            - 'rc.local'
            - 'bashrc'
            - 'profile'
    selection_numeric_traversal:
        CommandLine|contains:
            - '\..\'
            - '/../'
            - '..\'
            - '/..'
    condition: selection_unrar and (selection_traversal or selection_numeric_traversal)
    level: high
falsepositives:
    - Legitimate backup or migration scripts that restore configs or SSH keys
    - Development/testing scenarios
fields:
    - ParentImage
    - CommandLine
    - User
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-30333

YARA Rule

rule CVE_2022_30333_UnRAR_Directory_Traversal
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2024-01-15"
        description = "Detects RAR archive file entries with directory traversal sequences targeting sensitive paths"
        cve = "CVE-2022-30333"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-30333"
        severity = "high"

    strings:
        $traversal_a = /\.\.\/\.\.\/\.\.\//
        $traversal_b = /\.\.\\\.\.\\\.\.\\/
        $traversal_c = /\.\.\/\.\.\//
        $traversal_d = /\.\.\\\.\.\\/
        $ssh_key = /authorized_keys/
        $ssh_config = /\.ssh/
        $cron = /cron\.d/
        $systemd = /systemd\/system/
        $passwd = /etc\/passwd/
        $shadow = /etc\/shadow/
        $bashrc = /\.bashrc/
        $profile = /\.profile/
        $web_config = /\.htaccess/
        $php_webshell = /\.php/

    condition:
        uint32be(0) == 0x52617221 and (
            ($traversal_a or $traversal_b or $traversal_c or $traversal_d) and
            any of ($ssh_key, $ssh_config, $cron, $systemd, $passwd, $shadow, $bashrc, $profile, $web_config, $php_webshell)
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2022-30333 - RARLAB UnRAR Directory Traversal Attempt"; flow:established,to_server; content:".rar"; http.file_name; nocase; content:"../"; http.uri; nocase; detect_filter:track_by_src, count=5, seconds=60; content:!"Authorization"; http_header; classtype:attempted-admin; sid:2023033301; rev:1; metadata:created_at 2024_01_15, updated_at 2024_01_15, cve CVE-2022-30333, epss 0.99107;)

alert http any any -> $HOME_NET any (msg:"CVE-2022-30333 - RAR Upload with authorized_keys Traversal"; flow:established,to_server; content:".rar"; http.file_name; nocase; content:"authorized_keys"; http.server_body; nocase; content:"..\\"; http.server_body; nocase; classtype:attempted-admin; sid:2023033302; rev:1; metadata:created_at 2024_01_15, updated_at 2024_01_15, cve CVE-2022-30333;)

alert ftp any any -> $HOME_NET any (msg:"CVE-2022-30333 - FTP Upload of Traversal RAR"; flow:established; content:"STOR "; pcre:"/\.rar$/i"; content:"/\\\.\\\./\\\.\\\./"; pcre:"/\.\.\/\.\.\//"; classtype:attempted-admin; sid:2023033303; rev:1; metadata:created_at 2024_01_15, updated_at 2024_01_15, cve CVE-2022-30333;)

Elastic Detection

// Elastic EQL - Detect unrar process with traversal or sensitive target paths
sequence by process.entity_id
    [process where event.type == "start" and 
     process.name : "unrar" and
     process.args : ("x", "e") and
     process.args : ("*../*", "*..\\*")]
    [file where event.type == "creation" and
     file.path : ("/home/*/.ssh/*", "/root/.ssh/*", "/etc/cron.d/*", 
                  "/etc/systemd/system/*", "/etc/passwd*", "/etc/shadow*", 
                  "/var/www/html/*.php", "*/.bashrc", "*/.profile")]

// Alternate - detect file creation outside the extraction directory
sequence by process.entity_id
    [process where event.type == "start" and 
     process.name : "unrar" and
     process.args : ("x", "e")]
    [file where event.type == "creation" and
     file.path : "/etc/*" or
     file.path : "/root/*" or
     file.path : "/home/*/.ssh/*"]

Splunk SPL Query

index=main sourcetype=linux:audit
| search process_name=unrar
| eval extraction_dir=extract_path, file_created=file_path
| where file_path LIKE "%../%" OR file_path LIKE "%..\\%" 
   OR file_path LIKE "%authorized_keys%"
   OR file_path LIKE "%/etc/passwd%" 
   OR file_path LIKE "%/etc/shadow%" 
   OR file_path LIKE "%cron.d%"
| stats count by host, user, parent_process, process_name, file_path, command_line
| sort -count

Wazuh OSSEC Rule

<group name="cve_2022_30333,">
  <rule id="100301" level="15">
    <decoded_as>syslog</decoded_as>
    <match>unrar</match>
    <regex>\.\./\.\./|\.\.\\\.\.\\</regex>
    <description>CVE-2022-30333 | UnRAR directory traversal detected in command line</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve2022_30333,</group>
  </rule>

  <rule id="100302" level="14">
    <decoded_as>syslog</decoded_as>
    <match>unrar</match>
    <regex>authorized_keys|\.ssh|etc/passwd|etc/shadow|cron\.d</regex>
    <description>CVE-2022-30333 | UnRAR targeting sensitive filesystem locations</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve2022_30333,</group>
  </rule>

  <rule id="100303" level="15">
    <decoded_as>syslog</decoded_as>
    <match>unrar</match>
    <regex>\.\./\.\./\.\./</regex>
    <regex>authorized_keys|\.ssh|etc/passwd|etc/shadow|cron\.d</regex>
    <description>CVE-2022-30333 | UnRAR deep traversal targeting sensitive files - immediate response required</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve2022_30333,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (NVD, Debian) confirm the fix in UnRAR 6.12.

1. Immediate Mitigations (Do These Now)

• Upgrade UnRAR to version 6.12 or later immediately. The fix is minimal and non-disruptive.
• If upgrading is not immediately possible, disable automatic extraction of RAR archives from any untrusted source. Use alternative extraction tools (e.g., bsdtar, 7z) that have proper path sanitization.
• Run UnRAR in a sandboxed environment — use firejail, bwrap, Docker containers, or chroot to restrict filesystem access.
• Run UnRAR as an unprivileged user — never execute extraction with root or service-account privileges if avoidable. Create a dedicated low-privilege user for extraction tasks.
• Validate archives before extraction — use bsdtar -tf archive.rar to list file entries and reject any containing ../ or absolute paths.
• Apply filesystem-level controls — use fanotify or auditd rules to alert on writes to sensitive paths (.ssh, /etc, /root) from the extraction process.

2. Patch/Upgrade Steps

• Debian/Ubuntu: sudo apt update && sudo apt install unrar (ensure version ≥ 6.12). For non-free unrar: sudo apt install unrar-free (verify version).
• Red Hat/CentOS/Fedora: Use dnf update unrar or download the latest from rarlab.com.
• Source: Download UnRAR 6.12 or later from the official RARLAB website and compile:

  wget https://www.rarlab.com/rar/unrarsrc-6.12.tar.gz
  tar -xzf unrarsrc-6.12.tar.gz
  cd unrar
  make -f makefile
  sudo make -f makefile install
  

• Verify the fix: After upgrade, run unrar without arguments — version 6.12 or higher will be displayed.

3. Long-Term Hardening

• Inventory all systems using UnRAR. Update your configuration management (Ansible, Puppet, Chef) to enforce version ≥ 6.12.
• Substitute safer tools — replace UnRAR with libarchive-based tools (bsdtar) for automated extraction pipelines, as they have robust path traversal protections.
• Network-layer controls — block RAR file uploads at email/Web gateways unless absolutely necessary; inspect archive contents before delivery.
• Monitor the CISA KEV catalog — this CVE is marked as actively exploited; ensure it is included in your vulnerability management SLAs and remediation timelines.
• Honeypot files — place fake authorized_keys files with monitoring to catch extraction attempts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-30333
2. RARLAB Official Site: https://www.rarlab.com/rar_add.htm
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
4. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2022-30333
5. EPSS Data (FIRST.org): https://www.first.org/epss/

Threat Actor Campaigns / In-the-Wild Evidence:

• CISA KEV Inclusion: Added to the Known Exploited Vulnerabilities list with a mandatory remediation date of 2022-08-30, confirming active exploitation attempts in the wild.
• EPSS Score of 0.99107: This places the CVE in the 99.9th percentile of exploited vulnerabilities, indicating that it was among the most actively targeted vulnerabilities during its exploitation window.
• Known Attack Vector: The public proof-of-concept demonstrated in the NVD description specifically shows the ~/.ssh/authorized_keys write path, which has been widely weaponized by attackers targeting Linux servers with RAR extraction capabilities. No specific APT group attribution has been officially published, but the exploitation pattern resembles opportunistic botnet campaigns and automated scanning for vulnerable extraction services.