CVE-2022-30333 RARLAB UnRAR Directory Traversal
Attackers can exploit directory traversal in UnRAR to write arbitrary files, such as SSH keys, enabling remote code execution or privilege escalation.
- Exploited in the wild
- Since 9 Aug 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-30333?
CVE-2022-30333 is a critical path traversal vulnerability in Debian Debian Linux, published on 9 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
Which versions are affected by CVE-2022-30333?
It affects 2 products.
Linux distribution packages (3)
unrar SUSE:Linux Enterprise Server 12 SP5 | All versions | 5.6.1-4.8.1 |
unrar SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 5.6.1-4.8.1 |
unrar SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 5.6.1-4.8.1 |
Products include Debian Debian Linux, Rarlab Unrar.
How do I fix CVE-2022-30333?
Upgrade to a fixed version. US federal agencies must fix it by 30 Aug 2022.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-30333 being exploited?
Yes. Attackers have exploited CVE-2022-30333 in the wild since at least 9 Aug 2022, including in ransomware campaigns.
Public exploit code: 2 Metasploit modules and 5 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-30333, DLA-3534-1, GHSA-h4mr-p94x-gf79, MGASA-2022-0206, SUSE-SU-2022:1760-1, UBUNTU-CVE-2022-30333.