CVE-2025-14111

Executive Summary

CVE-2025-14111 is a path traversal vulnerability affecting RAR for Android (com.rarlab.rar) up to version 7.11 Build 127. The vulnerability allows an attacker to craft a malicious archive that, when extracted by the RAR app, can write files outside the intended extraction directory. This can lead to arbitrary file write or overwrite on the device, potentially enabling code execution or data corruption. The attack is remotely exploitable but requires user interaction (opening a malicious archive) and is considered highly complex. The vendor (Rarlab) has confirmed the issue is Android-specific and released a fix in version 7.20 build 128. WinRAR and Unix RAR versions are not affected.

Supply Chain & Package Security

This vulnerability is specific to the Android application distributed via Google Play and other Android app stores. It does not affect the underlying RAR library used in other platforms. Users should ensure they update the app directly from the official store.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The malicious archive can be delivered remotely.
• Attack Complexity: High (AC:H) – Exploitation requires a crafted archive and specific conditions.
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – User must open the archive.
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – Arbitrary file read possible.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the potential for arbitrary file write on a mobile device could lead to serious consequences, including data theft or app sandbox escape.

Deep Dive & Mechanics

The vulnerability resides in the com.rarlab.rar component, which handles the extraction of RAR archives. The core issue is a path traversal flaw (CWE-22). When extracting an archive, the application fails to properly sanitize file paths within the archive. An attacker can craft a RAR file containing entries with path traversal sequences (e.g., ../../file.txt) that, when extracted, write files outside the designated extraction directory.

Technical Details:

• The vulnerable code likely uses a function that concatenates the extraction path with the entry name without checking for ../ sequences.
• For example, if the extraction path is /data/data/com.rarlab.rar/files/, an entry named ../../sdcard/malicious.txt would result in writing to /sdcard/malicious.txt.
• This can be used to overwrite critical system files, inject malicious code into other apps, or exfiltrate sensitive data.

Affected Component: com.rarlab.rar (the core RAR extraction library for Android).

Mitigation: Upgrade to version 7.20 build 128, which includes proper path validation.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct concatenation without sanitization
String extractPath = "/data/data/com.rarlab.rar/files/";
String entryName = archiveEntry.getName(); // e.g., "../../sdcard/evil.txt"
File outputFile = new File(extractPath + entryName);
// No check for path traversal

Patched Code (Conceptual):

// Patched: Sanitize the entry name
String extractPath = "/data/data/com.rarlab.rar/files/";
String entryName = archiveEntry.getName();
// Normalize and check for traversal
File outputFile = new File(extractPath, entryName);
String canonicalPath = outputFile.getCanonicalPath();
if (!canonicalPath.startsWith(extractPath)) {
    throw new SecurityException("Path traversal detected");
}
// Proceed with extraction

The patched version uses getCanonicalPath() to resolve the absolute path and then verifies it starts with the intended extraction directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A malicious RAR archive with path traversal entries.
• Target device running RAR for Android < 7.20 build 128.

Steps:

1. Create a RAR archive with a file entry containing path traversal:

   $ rar a malicious.rar ../../sdcard/evil.txt
   

   (This adds a file that will be extracted to /sdcard/evil.txt relative to the extraction base.)

2. Deliver the archive to the victim (e.g., via email, download link).

3. When the victim opens the archive with the vulnerable RAR app, the file is written outside the intended directory.

Example Payload:

• Overwrite a configuration file in /data/data/com.victim.app/ to inject malicious settings.
• Write a script to /sdcard/ that gets executed by another app.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual file writes outside the app’s sandbox.
• Use file integrity monitoring (FIM) on critical system paths.
• Analyze RAR archives for path traversal patterns before extraction.

Defense:

• Ensure RAR for Android is updated to version 7.20 build 128 or later.
• Implement application whitelisting to prevent unauthorized app installations.
• Use mobile device management (MDM) to enforce updates.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes may vary)
  • malicious.rar: a1b2c3d4e5f6...
  • Extracted file: ../../sdcard/evil.txt (path traversal indicator)
• Network: Connections to known malicious domains delivering the archive.
• Process: com.rarlab.rar process writing to unexpected paths.
• Logs: Android logcat entries showing extraction errors or path traversal warnings.

Detection Engineering

YARA Rule

rule CVE_2025_14111_RAR_Path_Traversal {
    meta:
        description = "Detects RAR archives with path traversal patterns targeting CVE-2025-14111"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14111"
    strings:
        $path_traversal = /\.\.\/[^\/]+/  // Matches "../" sequences
        $rar_magic = { 52 61 72 21 1A 07 00 }  // RAR magic bytes
    condition:
        $rar_magic at 0 and #path_traversal > 0
}

Sigma Rule

title: CVE-2025-14111 RAR Path Traversal Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit path traversal in RAR for Android
author: Valters IT
logsource:
    product: android
    service: logcat
detection:
    selection:
        - EventID: 1000  # Example: File write event
          TargetPath|contains: ".."
          ProcessName: "com.rarlab.rar"
    condition: selection
falsepositives:
    - Legitimate archives with unusual names
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-14111 RAR Path Traversal - Malicious Archive Download"; flow:to_server; content:"rar"; http_uri; pcre:"/\.\.\//"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update RAR for Android to version 7.20 build 128 or later from Google Play or the official website.
2. Verify update by checking the app version in Settings > Apps > RAR.

Long-term Measures:

• Implement input validation for all archive extraction operations.
• Use secure coding practices, such as canonical path checks.
• Educate users about the risks of opening archives from untrusted sources.

Workarounds:

• If update is not possible, avoid opening RAR archives from unknown senders.
• Use alternative archive extraction apps that are not affected.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions or further analysis, contact threatintel@valtersit.com.