WinRAR Vulnerability Affects Traders Worldwide
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion RARLAB WinRAR before 6.23 mishandles ZIP archives that contain a benign file (such as a JPG) alongside a folder with the same name, causing the folder's contents - which can include malicious executable files - to be processed when the user merely attempts to view the benign file. By sending a crafted ZIP archive, an attacker gains arbitrary code execution on the victim's machine with the user's privileges. Because the flaw is local (AV:L) and requires user interaction, risk is limited to Windows systems running an unpatched copy of WinRAR, while machines without the tool are unaffected. The bug was actively exploited in the wild from April through October 2023, including by government-backed actors (APT28), SideCopy attacks on Indian government entities, ransomware operations, and trading-account theft campaigns, and it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24. Do: Upgrade all Windows systems running WinRAR to version 6.23 or later, which fixes this flaw; if patching is not immediately possible, treat ZIP files from untrusted sources with caution and check archives for duplicate file/folder names before opening. Given KEV listing with known ransomware use and public proof-of-concept exploits, hunt for compromise by reviewing whether unexpected executables or scripts ran when ZIP archives were opened, and apply vendor mitigations per CISA's required action or discontinue use if mitigations are unavailable. | 7.8 | 98% | KEV ransomware PoC ×4 |
| masshundreds of millions of users/installations worldwide (WinRAR is one of the most widely installed Windows archive utilities) |
Full article315 words · extracted from infosecurity-magazine.com · click to collapse
Cybersecurity researchers have exposed a zero-day vulnerability (CVE-2023-38831) in the popular WinRAR compression tool, which cyber-criminals have exploited to target traders on specialized forums.
The exploit allows threat actors to craft ZIP archives that contain malicious payloads, posing a significant risk to traders’ financial assets.
The Group-IB Threat Intelligence unit, while investigating the distribution of DarkMe malware in July 2023, stumbled upon the previously unknown vulnerability in WinRAR’s processing of the ZIP file format.
According to an advisory published by Andrey Polovinkin, a malware analyst at Group-IB earlier today, cyber-criminals have been using this vulnerability since April 2023 to create ZIP archives containing malware families including DarkMe, GuLoader and Remcos RAT.
Upon discovering this security flaw, Group-IB promptly notified RARLAB, the developers of WinRAR, about the issue. The company collaborated with the researchers and swiftly released a patch to address the vulnerability. MITRE Corporation assigned the vulnerability the marker CVE-2023-38831 on August 15 2023.
The exploit involves tricking users into opening seemingly harmless files, which then launch malicious scripts. Cyber-criminals are leveraging a tactic in which they spoof file extensions to hide the execution of malicious code within files that appear to be images or text documents. Group-IB explained that these malicious archives were posted on various trading forums, infecting at least 130 devices at the time of reporting.
Once infected, the malware provides threat actors unauthorized access to victims’ brokerage accounts, enabling them to withdraw funds. The financial losses incurred due to this vulnerability are still under investigation. Notably, the same vulnerability was reportedly used in the DarkCasino campaign previously described by NSFOCUS researchers.
Group-IB urged users to keep their software updated, exercise caution when dealing with attachments from unknown sources and implement robust security practices such as using password managers and enabling two-factor authentication (2FA).
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/winrar-flaw-affects-traders/