Latest WinRAR, Drupal flaws under active exploitation

WinRAR versions through 5.61 contain a path traversal flaw (CWE-22, also mapped to CWE-36) in the UNACEV2.dll library used to unpack ACE-format archives: when a crafted archive's filename field contains absolute-path patterns, WinRAR ignores the user-selected extraction destination and writes the file to any absolute path the attacker specifies. It is triggered by inducing a user to open a malicious ACE archive (user interaction required), allowing arbitrary file placement on the endpoint — for example, writing an executable to a Windows startup folder to achieve code execution at next logon, as demonstrated in the original Check Point research. Only RARLAB WinRAR is affected, and the issue was assigned by Check Point acting as CNA, with multiple public proofs of concept available. Exploitation is well established: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-02-15) with known ransomware use (e.g., JNEC.a delivered via this exploit), has been linked to targeted-activity by threat actors, and EPSS currently assigns a 96.3% probability of exploitation within 30 days. Because WinRAR lacks an automatic update mechanism, stale installations remained exposed and under active attack long after the vendor fix was published.

Do: Apply updates per vendor instructions by upgrading to a WinRAR release newer than 5.61, in which the vulnerable ACE handling is patched or replaced; ensure endpoints actually run the updated build given WinRAR does not auto-update. If patching cannot be done promptly, delete or neutralize UNACEV2.dll (disabling ACE extraction) or unpack ACE archives with a patched alternative, and scrutinize ACE attachments arriving via email. Hunt for unexpected files dropped into auto-run locations (e.g., startup folders) and treat this as a KEV entry with the corresponding federal remediation deadline.

Several field types in Drupal 8.5.x and 8.6.x fail to properly sanitize data arriving from non-form sources (CWE-502, deserialization of untrusted data), which can lead to arbitrary PHP code execution on the server. The flaw is triggered remotely when a site has the Drupal 8 RESTful Web Services (rest) core module enabled and accepts PATCH or POST requests, or when other web services modules are enabled, such as JSON:API on Drupal 8 or the Services and RESTful Web Services contributed modules on Drupal 7. A successful attack yields unauthenticated remote code execution with high impact on confidentiality, integrity, and availability, typically running as the web server user. Only Drupal sites meeting the web-services conditions are affected: Drupal 8 sites running versions before 8.5.11 or 8.6.10, and Drupal 7 sites using the Services or RESTful Web Services contributed modules. The flaw has public proof-of-concept exploits on Exploit-DB, was reported as under active exploitation shortly after disclosure, and is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25).

Do: Upgrade Drupal 8 core to 8.5.11 or later, or 8.6.10 or later, per vendor instructions. If patching is not immediately possible, disable the RESTful Web Services and JSON:API modules or restrict untrusted PATCH/POST requests to their endpoints; Drupal 7 sites using Services or RESTful Web Services should apply the contributed module updates from this advisory. Review web server and module logs for suspicious POST/PATCH requests to REST or JSON:API routes as evidence of compromise.