Beware: Fake Exploit for WinRAR Vulnerability on GitHub Infects Users with Venom RAT
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-25157 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse. NVD description · AI analysis pending | 9.8 | 85% |
| — | ||
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion RARLAB WinRAR before 6.23 mishandles ZIP archives that contain a benign file (such as a JPG) alongside a folder with the same name, causing the folder's contents - which can include malicious executable files - to be processed when the user merely attempts to view the benign file. By sending a crafted ZIP archive, an attacker gains arbitrary code execution on the victim's machine with the user's privileges. Because the flaw is local (AV:L) and requires user interaction, risk is limited to Windows systems running an unpatched copy of WinRAR, while machines without the tool are unaffected. The bug was actively exploited in the wild from April through October 2023, including by government-backed actors (APT28), SideCopy attacks on Indian government entities, ransomware operations, and trading-account theft campaigns, and it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24. Do: Upgrade all Windows systems running WinRAR to version 6.23 or later, which fixes this flaw; if patching is not immediately possible, treat ZIP files from untrusted sources with caution and check archives for duplicate file/folder names before opening. Given KEV listing with known ransomware use and public proof-of-concept exploits, hunt for compromise by reviewing whether unexpected executables or scripts ran when ZIP archives were opened, and apply vendor mitigations per CISA's required action or discontinue use if mitigations are unavailable. | 7.8 | 98% | KEV ransomware PoC ×4 |
| masshundreds of millions of users/installations worldwide (WinRAR is one of the most widely installed Windows archive utilities) | |
| CVE-2023-40477 | RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233. NVD description · AI analysis pending | 7.8 | 11% |
| — |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | checkblacklistwords.eu | opposed to running the PoC, reaches out to a remote server (checkblacklistwords[.]eu) to fetch an executable named Windows.Gaming.Preview.exe, |
Full article390 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 21, 2023Vulnerability / Exploit
A malicious actor released a fake proof-of-concept (PoC) exploit for a recently disclosed WinRAR vulnerability on GitHub with an aim to infect users who downloaded the code with Venom RAT malware.
"The fake PoC meant to exploit this WinRAR vulnerability was based on a publicly available PoC script that exploited a SQL injection vulnerability in an application called GeoServer, which is tracked as CVE-2023-25157," Palo Alto Networks Unit 42 researcher Robert Falcone said.
While bogus PoCs have become a well-documented gambit for targeting the research community, the cybersecurity firm suspected that the threat actors are opportunistically targeting other crooks who may be adopting the latest vulnerabilities into their arsenal.
whalersplonk, the GitHub account that hosted the repository, is no longer accessible. The PoC is said to have been committed on August 21, 2023, four days after the vulnerability was publicly announced.
CVE-2023-40477 relates to an improper validation issue in the WinRAR utility that could be exploited to achieve remote code execution (RCE) on Windows systems. It was addressed last month by the maintainers in version WinRAR 6.23, alongside another actively-exploited flaw tracked as CVE-2023-38831.
An analysis of the repository reveals a Python script and a Streamable video demonstrating how to use the exploit. The video attracted 121 views in total.
The Python script, as opposed to running the PoC, reaches out to a remote server (checkblacklistwords[.]eu) to fetch an executable named Windows.Gaming.Preview.exe, which is a variant of Venom RAT. It comes with capabilities to list running processes and receive commands from an actor-controlled server (94.156.253[.]109).
A closer examination of the attack infrastructure shows that the threat actor created the checkblacklistwords[.]eu domain at least 10 days prior to the public disclosure of the flaw, and then swiftly seized upon the criticality of the bug to attract potential victims.
"An unknown threat actor attempted to compromise individuals by releasing a fake PoC after the vulnerability's public announcement, to exploit an RCE vulnerability in a well-known application," Falcone said.
"This PoC is fake and does not exploit the WinRAR vulnerability, suggesting the actor tried to take advantage of a highly sought after RCE in WinRAR to compromise others."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/09/beware-fake-exploit-for-winrar.html