Actively exploited · Published May 9, 2022 · Assigned by mitre
CVE-2022-30333
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity path traversal in UnRAR from RARLAB. Attackers are actively exploiting it in the wild (listed by CISA on August 9, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.2% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Aug 30, 2022.
Official description
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rar | 2:6.20~b1-0.1 | DEBIAN-CVE-2022-30333 |
| Debian:13 | rar | 2:6.20~b1-0.1 | DEBIAN-CVE-2022-30333 |
| Debian:14 | rar | 2:6.20~b1-0.1 | DEBIAN-CVE-2022-30333 |
| Debian:12 | unrar-nonfree | 1:6.1.7-1 | DEBIAN-CVE-2022-30333 |
| Debian:13 | unrar-nonfree | 1:6.1.7-1 | DEBIAN-CVE-2022-30333 |
| Debian:14 | unrar-nonfree | 1:6.1.7-1 | DEBIAN-CVE-2022-30333 |
| Ubuntu:22.04:LTS | libclamunrar | 0.103.11-0ubuntu0.22.04.1 | USN-6569-1 |
| Ubuntu:22.04:LTS | libclamunrar | 0.103.11-0ubuntu0.22.04.1 | UBUNTU-CVE-2022-30333 |
| Ubuntu:22.04:LTS | rar | 2:6.23-1~22.04.1 | USN-7349-1 |
| Ubuntu:22.04:LTS | rar | 2:6.23-1~22.04.1 | UBUNTU-CVE-2022-30333 |
| Ubuntu:24.04:LTS | rar | 2:6.23-1 | UBUNTU-CVE-2022-30333 |
| Ubuntu:22.04:LTS | unrar-nonfree | 1:6.1.5-1ubuntu0.1 | UBUNTU-CVE-2022-30333 |
| Ubuntu:22.04:LTS | unrar-nonfree | 1:6.1.5-1ubuntu0.1 | USN-7350-1 |
Affected products (as reported)
Weakness: CWE-59, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.rarlab.com/rar_add.htm
- https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz
- https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/
- http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html
- [debian-lts-announce] 20230817 [SECURITY] [DLA 3534-1] rar security update mailing-list
- GLSA-202309-04 vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30333 government-resource