File extension spoofing in WinRAR

1) Input validation error

EUVDB-ID: #VU79925

Risk: Critical

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2023-38831

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of file names inside .zip archives. A remote attacker can create a specially crafted archive that contains executable malicious files and spoof their file extension to look like .jpeg or .txt.

Note, the vulnerability is being actively exploited in the wild as of April 2023.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

WinRAR: 3.20 - 6.23 beta 1

CPE2.3

• cpe:2.3:a:rarlab:winrar:3.20:*:*:*:*:*:*:*
• cpe:2.3:a:rarlab:winrar:4.00:*:*:*:*:*:*:*
• cpe:2.3:a:rarlab:winrar:4.01:*:*:*:*:*:*:*

External links

http://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to open a a specially crafted archive.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.