PMG accepts RAR5 archives with unsupported extraction method (v6:m3:512K) containing VBS files

R

romin1952

New Member
Nov 8, 2024
3
0
1
Environment:

  • Proxmox Mail Gateway 8.2.11
  • ClamAV 1.4.3
  • Debian Bookworm
  • p7zip-full 16.02+really25.01
A malicious email containing a RAR5 archive bypasses PMG.

Archive information:

Type = Rar5
Method = v6:m3:512K
Contained file = Remittance Copy.vbs

PMG log:

found archive 'Remittance Copy-1.rar' (application/vnd.rar)

unpack failed - child 'XXXX' failed: 512

accept mail to (rule: default-accept)

Manual testing:

7z l archive.rar -> shows Remittance Copy.vbs

7z x archive.rar -> ERROR: Unsupported Method : Remittance Copy.vbs

The extracted file is empty (0 bytes) and therefore ClamAV reports OK.

Other mail systems detect or block the message:

  • Gmail blocks it
  • Windows Defender detects it
  • Mailcow/Rspamd detects MIME_BAD_EXTENSION [vbs]
Expected behavior:

If PMG cannot unpack an archive because of an unsupported compression method, the message should not be silently accepted by default.

Possible solutions:

  • treat unpack failures as dangerous content;
  • allow Archive Filter / Match Filename to act on file names discovered during archive listing;
  • provide an option to quarantine archives with unpack failures.

    I can provide the sample archive privately if required.
 
Last edited:
ArchiveFilter supports an undocumented content type:

proxmox/unreadable-archive

It can be added via:

pmgsh create /config/ruledb/what/<ID>/archivefilter \
--contenttype 'proxmox/unreadable-archive'

This allows quarantining only archives that PMG failed to unpack
(e.g. "unpack failed - child XXXX failed: 512"),
while allowing normal ZIP/RAR/7z archives
 
You must log in or register to reply here.
Top Bottom
Back