Security Analysis: Path Traversal Exploitation in WinRAR (CVE-2025-8088)

Note: Repository under development. This project will receive future updates with additional analyses, analysis scripts (non-exploit), and presentation material. New versions will be published as soon as they are available.

This repository documents the analysis, the study process, and the proof of concept (PoC) for the Directory Traversal vulnerability (CWE-35) in WinRAR (CVE-2025-8088).

The flaw affects WinRAR versions for Windows prior to 7.13 and was classified with High severity (Base Score 8.8).

I. The Infection Process: From ZIP File to Arbitrary Code

The success of CVE-2025-8088 lies in the simplicity of the interaction required from the victim: code execution is triggered merely by extracting a malicious file.

The Simple Attack Vector

1. Social Engineering (Phishing): Threat groups such as RomCom and Paper Werewolf used this vulnerability in spear phishing campaigns.
2. The Lure (Decoy): Attackers sent malicious RAR files disguised as legitimate documents, such as resumes or financial reports.
3. The User's Action: The victim, attempting to access the content, extracts the malicious RAR file with a vulnerable version of WinRAR (≤ 7.12).
4. The Hidden Exploitation: During extraction, instead of the file being placed in the expected destination directory, the Path Traversal flaw forces WinRAR to write the payload (malicious code) to a critical operating system folder.

The Consequence: Persistence on the Operating System

The exploit's main target is the Windows startup folder (AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\).

• When the vulnerable WinRAR extracts the file, the payload is placed in the Startup folder.
• The next time the user logs in (after a restart or logout), the payload is automatically executed, ensuring persistence.

This pattern was used by threat groups such as RomCom to deploy backdoors that granted full access to compromised computers.

II. Study Processes and Technical Analysis for Exploitation

Developing a robust proof of concept requires an in-depth study of the binary structures of the RAR format and the peculiarities of the Windows operating system.

1. RAR 5.0 Header Manipulation

The vulnerability is exploited through the manipulation of RAR file headers. Attackers cannot simply rename a file; they must force WinRAR to accept a malicious path, which is stored in the file structure.

• File Structure: The study requires understanding how data blocks, such as the File header and the Service header, are formatted. The Name length field and the Name field (which contains the path) within the file header are modified.
• Binary Patching: The exploitation script applies patches to RAR headers to inject the path traversal sequence (..\..\..\).
• File Integrity: For the modified file to appear valid to WinRAR, the script needs to recalculate the CRC checksums (Cyclic Redundancy Checksums). This type of binary manipulation is often performed with modules such as Python's struct, used to interpret bytes as packed binary data.

2. Multi-Depth Traversal Strategy

The study revealed that a major challenge for exploitation was the uncertainty about the exact extraction directory (Desktop, Downloads, etc.).

• Study Solution: The Multi-Depth Traversal Strategy was developed.
• How It Works: The exploit creates multiple decoy files (for example, 20 File.txt files). Each file is configured to attempt traversing a different number of parent directories (example: ..\Startup\payload.bat, then ..\..\Startup\payload.bat, up to 20 depths).
• Benefit: This redundancy ensures that, regardless of the directory depth where the victim extracts the file, at least one of the payloads will reach the fixed destination (the Windows Startup folder).

3. Stealth through Alternate Data Streams (ADS)

To embed the payload stealthily, the research uses an exclusive feature of the Windows NTFS file system: Alternate Data Streams (ADS).

• The payload (a batch script or executable) is attached to a decoy file (such as a professional PDF) via ADS.
• The use of ADS and Windows-specific paths, such as RELATIVE_DROP_PATH, are the main reasons why generating the exploit requires a Windows environment.

III. Defense Mitigations

The CVE-2025-8088 vulnerability has been actively exploited (in the wild) and is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog.

The most critical defense is updating, since exploitation depends on outdated software:

• Update WinRAR to version 7.13 or higher.
• Disable the extraction of files from untrusted sources.
• Monitor security logs to detect unauthorized writes to the Windows startup folders.

---

Study Analogy: Imagine the RAR file as a postal parcel. Path Traversal is like filling in the delivery address with repeated "return to sender" commands (../). The technical study involved discovering exactly which part of the parcel label (the RAR header) needed to be tampered with and how many "return" commands would be needed (the multi-depth strategy) to ensure that, no matter where the mail service (WinRAR) started, the package would be deposited in the safe (the Startup folder). The simple act of "accepting the package" (extracting) ensures infection.