CVE-2022-30333

What it actually does

RARLAB UnRAR on Linux and UNIX before version 6.12 fails to safely normalize and constrain file paths contained in a RAR archive during extraction. A malicious archive can include path traversal entries that cause UnRAR to write files outside the intended extraction directory. The attacker-controlled write occurs with the privileges of the user or service performing the extraction, enabling modification or creation of sensitive files such as SSH authorized keys, application configuration files, web-accessible scripts, or other files reachable by that account. WinRAR and Android RAR are not affected.

Why it matters to the business

Systems and applications that automatically process RAR archives can be compromised by simply handling a malicious archive. Because this issue is listed in CISA KEV, has very high EPSS likelihood, is known to be exploited in the wild, and has been associated with ransomware activity, exposed or automated archive-processing workflows should be treated as high urgency. Successful exploitation can lead to unauthorized access, persistence, tampering with application behavior, web shell placement, service disruption, and follow-on ransomware or data theft activity. The CISA KEV remediation deadline was 2022-08-30, so any remaining exposure is materially overdue.

How an attack unfolds

An attacker creates a RAR archive containing filenames with directory traversal sequences or crafted paths that escape the intended extraction directory. The attacker then causes a vulnerable Linux or UNIX system to extract the archive, either by sending it to an application that automatically unpacks attachments/uploads or by convincing an operator or workflow to process it. During extraction, vulnerable UnRAR versions write attacker-controlled content to an arbitrary path accessible to the extracting process. If the target path is security-sensitive, such as an SSH authorized_keys file, a web application directory, a scheduled task location, or an application configuration file, the attacker can gain persistence, remote access, or code execution through the affected application or account. In real-world campaigns, this class of vulnerability is especially dangerous in mail gateways, collaboration platforms, file upload processors, malware sandboxes, and content-scanning systems that unpack archives without user interaction.

How to fix it

Upgrade RARLAB UnRAR to version 6.12 or later, or install the vendor/distribution package that backports the fix. For source-based or pinned deployments, ensure the vulnerable path traversal fix is present; the supplied fixed-version data references commit adc218676eef25575469234709c2d87185ca223a. Prioritize systems that automatically extract archives, including email security stacks, web upload handlers, collaboration platforms, CI/CD jobs, file processing services, and malware analysis pipelines. If immediate upgrade is not possible, temporarily disable RAR extraction, block or quarantine RAR uploads/attachments, run extraction in a sandboxed low-privilege account with a confined filesystem, prevent writes outside a disposable extraction directory, and monitor for unexpected file creation by archive-processing services. Remove duplicate or statically bundled copies of unrar, as applications may carry their own vulnerable binaries independent of the operating system package manager.

How to confirm the fix worked

Confirm the installed UnRAR version reports 6.12 or later, or that the operating system package changelog explicitly includes the fix for this vulnerability. Inventory both system packages and embedded binaries by searching for unrar, unrar-free, rar, and application-bundled extractor utilities. Validate that archive-processing services run with least privilege and cannot write to sensitive locations such as user home directories, SSH configuration paths, application web roots, cron directories, or service startup paths. In a controlled test environment only, use a benign traversal test archive and verify that extraction either rejects traversal entries or confines all output to the intended directory. Review file integrity monitoring and endpoint telemetry to ensure archive extraction cannot create files outside approved temporary extraction paths.

Typical attack path

1. Identify an internet-facing or automated workflow that accepts, scans, or extracts RAR archives on Linux or UNIX.
2. Craft a malicious RAR archive containing traversal paths that escape the configured extraction directory.
3. Deliver the archive through email, file upload, shared storage, ticketing, collaboration, or another ingestion channel.
4. Wait for the vulnerable UnRAR process to extract the archive automatically or as part of normal processing.
5. Use the arbitrary file write to place or modify a file such as an SSH key, web shell, configuration file, startup script, or application-controlled resource.
6. Trigger or access the modified file to obtain persistence, remote access, or application-level code execution.
7. Perform follow-on activity such as credential access, lateral movement, data staging, or ransomware deployment.

How to detect it

Look for evidence that a vulnerable UnRAR binary processed a malicious archive and wrote files outside the intended extraction directory. Useful sources include EDR process telemetry, shell history, application upload logs, mail gateway and content-scanning logs, web server access/error logs, file integrity monitoring, auditd logs, SSH authentication logs, cron/systemd change logs, and package inventory. Search for unrar processes that handled recently received archives, especially when followed by writes to home directories, SSH directories, web roots, application plugin directories, cron paths, or service configuration locations. Inspect RAR archive listings from suspicious samples for '../', absolute paths, home-directory paths, or filenames targeting authorized_keys or web-executable extensions. Review timestamps: file creation or modification shortly after archive extraction is a strong signal. On systems that automatically process attachments or uploads, correlate inbound RAR files with new files created by the archive-processing service account. Because exploitation has been observed in the wild and is associated with ransomware activity, also hunt for post-exploitation indicators such as unexpected SSH logins, new web-accessible scripts, outbound command-and-control connections, credential dumping, privilege escalation attempts, encryption tooling, and abnormal file renames.

• ~/.ssh/authorized_keys
• /.ssh/authorized_keys
• authorized_keys
• ../
• ..\\
• /etc/cron.d/
• /etc/crontab
• /var/spool/cron/
• /tmp/unrar
• /usr/bin/unrar
• /usr/local/bin/unrar
• unrar x
• unrar e
• UNRAR
• Cannot create
• ../.ssh/authorized_keys
• .jsp
• webshell
• /opt/zimbra/jetty/webapps/
• /var/www/html/
• /usr/share/nginx/html/
• /var/www/

What your security team should do

• Immediately identify Linux and UNIX systems and applications that process RAR archives, with priority on internet-facing, email-facing, and automated ingestion workflows.
• Patch or replace RARLAB UnRAR versions earlier than 6.12, including bundled binaries inside third-party applications and containers.
• Because this vulnerability is in CISA KEV, has active exploitation, very high EPSS, and ransomware association, treat unpatched exposure as an incident-response priority rather than routine maintenance.
• Temporarily disable RAR extraction or quarantine RAR attachments/uploads where patching cannot be completed quickly.
• Harden archive extraction by using sandboxed workers, low-privilege service accounts, read-only application directories, filesystem namespaces, and allowlisted output directories.
• Hunt for suspicious file creation shortly after RAR extraction events, especially authorized_keys files, web shells, cron entries, startup scripts, and modified application configuration files.
• Review authentication logs, web server logs, EDR process trees, and file integrity alerts for activity following archive ingestion or extraction.
• Add detection rules for traversal strings and suspicious paths inside RAR archive listings and extraction logs.
• Rebuild affected containers or appliances from patched base images rather than only patching running instances.
• If suspicious arbitrary file writes are found, rotate affected credentials and keys, preserve forensic evidence, and investigate for persistence and lateral movement.