WinRAR Security Flaw Exploited in Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion RARLAB WinRAR before 6.23 mishandles ZIP archives that contain a benign file (such as a JPG) alongside a folder with the same name, causing the folder's contents - which can include malicious executable files - to be processed when the user merely attempts to view the benign file. By sending a crafted ZIP archive, an attacker gains arbitrary code execution on the victim's machine with the user's privileges. Because the flaw is local (AV:L) and requires user interaction, risk is limited to Windows systems running an unpatched copy of WinRAR, while machines without the tool are unaffected. The bug was actively exploited in the wild from April through October 2023, including by government-backed actors (APT28), SideCopy attacks on Indian government entities, ransomware operations, and trading-account theft campaigns, and it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24. Do: Upgrade all Windows systems running WinRAR to version 6.23 or later, which fixes this flaw; if patching is not immediately possible, treat ZIP files from untrusted sources with caution and check archives for duplicate file/folder names before opening. Given KEV listing with known ransomware use and public proof-of-concept exploits, hunt for compromise by reviewing whether unexpected executables or scripts ran when ZIP archives were opened, and apply vendor mitigations per CISA's required action or discontinue use if mitigations are unavailable. | 7.8 | 98% | KEV ransomware PoC ×4 |
| masshundreds of millions of users/installations worldwide (WinRAR is one of the most widely installed Windows archive utilities) | |
| CVE-2023-40477 | RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233. NVD description · AI analysis pending | 7.8 | 11% |
| — |
Full article433 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 24, 2023Endpoint Security / Zero-Day
A recently patched security flaw in the popular WinRAR archiving software has been exploited as a zero-day since April 2023, new findings from Group-IB reveal.
The vulnerability, cataloged as CVE-2023-38831, allows threat actors to spoof file extensions, thereby making it possible to launch malicious scripts contained within an archive that masquerades as seemingly innocuous image or text files. It was addressed in version 6.23 released on August 2, 2023, alongside CVE-2023-40477.
In attacks discovered by the Singapore-based firm in July 2023, specially crafted ZIP or RAR archive files distributed via trading-related forums such as Forex Station have been used to deliver a variety of malware families such as DarkMe, GuLoader, and Remcos RAT.
"After infecting devices, the cybercriminals withdraw money from broker accounts," Group-IB malware analyst Andrey Polovinkin said, adding as many as 130 traders' devices have been compromised as part of the campaign. The total number of victims and financial losses stemming from this activity are currently not clear.
The booby-trapped archive file is created such that it contains an image file as well as a folder with the same name.
As a result, when a victim clicks on the image, a batch script present within the folder is executed instead, which is then used to launch the next-stage, an SFX CAB archive designed to extract and launch additional files. At the same time, the script also loads the decoy image so as not to arouse suspicion.
"CVE-2023-38831 is caused by a processing error in opening the file in the ZIP archive," Polovinkin told The Hacker News. "Weaponized ZIP archives have been distributed on at least 8 popular trading forums, so the geolocation of victims is broad, and the attacks are not targeted at specific countries or industries."
It's not yet known who is behind the attacks leveraging the WinRAR flaw. That said, DarkMe is a Visual Basic trojan attributed to the EvilNum group, first documented by NSFOCUS in September 2022 in connection with a phishing campaign codenamed DarkCasino targeting European online gambling and trading services.
Also delivered using this method is a malware strain called GuLoader (aka CloudEye) that subsequently attempts to fetch Remcos RAT from a remote server.
"Recent cases of exploitation of CVE-2023-38831 remind us of the constant risks connected to software vulnerabilities," Polovinkin said. "Threat actors are highly resourceful, and they will always find new ways to discover and subsequently exploit vulnerabilities."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/08/winrar-security-flaw-exploited-in-zero.html