CVE-2022-30333: RARLAB UnRAR Directory Traversal Vulnerability

Vulnerability summary

CVE-2022-30333 is a critical (CVSS 9.8) Path Traversal vulnerability in RARLAB UnRAR. It is known to be exploited: CISA lists it, first on 09-08-2022. It has been used in ransomware campaigns. EPSS estimates a 99.23% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 09-05-2022
   PublishedVulnerability first disclosed.
2. 09-08-2022
   Added to CISA KEVRARLAB UnRAR Directory Traversal Vulnerability
3. 30-08-2022
   CISA remediation dueApply updates per vendor instructions.
4. 01-10-2026
   Last modifiedVulnerability information updated.

Description

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.