New UnRAR Vulnerability Could Lead to Zimbra Webmail Hack

A new flaw has been uncovered in RARlab’s UnRAR utility that could be exploited to steal emails from personal Zimbra mail user accounts.

The route traversal vulnerability, found in the Unix versions of UnRAR, has been assigned CVE-2022-30333 and a foundation rating of 7.5 in the Common Vulnerability Scoring Process (CVSS).

For context, Zimbra is an company email remedy used by over 200,000 organizations, governing administration and money establishments.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Security scientists from Sonar ended up reportedly the first to discover the UnRAR bug and produced an advisory about it on Tuesday.

“We identified a -day vulnerability in the UnRAR utility, a 3rd party software employed in Zimbra,” reads the doc.

The flaw would let an attacker to develop files outdoors the target extraction listing when an application or sufferer user extracts an untrusted archive. 

“If they can create to a known place, they are very likely to be able to leverage it in a way foremost to the execution of arbitrary instructions on the process,” wrote Sonar.

In accordance to the advisory, successful exploitation would give attackers obtain to all email messages sent and obtained on a compromised email server.

“They can silently backdoor login functionalities and steal the qualifications of an organization’s users. With this obtain, it is most likely that they can escalate their entry to even far more sensitive, internal expert services of an firm.”

The only necessity for this attack is that UnRAR was mounted on the server, which Sonar explained would be possible as it is essential for RAR archive virus scanning and spam-examining.

Sonar reportedly warned RarLab about the flaw on May well 04, and the corporation introduced a patch on May well 06 as part of version 6.12. Other versions of the application, which includes those for Windows and Android operating devices, are not impacted by the vulnerability.

The resolve comes practically a year right after Zimbra was talked about in a joint US and UK governing administration report identifying the enterprise as a possible focus on of Russian spies.