CVE-2023-38831 RARLAB WinRAR Code Execution
Attackers can execute arbitrary code by tricking users into viewing a benign file in a specially crafted ZIP archive where a folder shares the file's name.
- Exploited in the wild
- Since 24 Aug 2023
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-38831?
CVE-2023-38831 is a high-severity code injection vulnerability in n/a, published on 23 Aug 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.
Which versions are affected by CVE-2023-38831?
It affects 1 product.
Products include Rarlab Winrar.
How do I fix CVE-2023-38831?
No fix has been published for CVE-2023-38831 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Sep 2023.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-38831 being exploited?
Yes. Attackers have exploited CVE-2023-38831 in the wild since at least 24 Aug 2023, including in ransomware campaigns.
Public exploit code: 1 Metasploit module and 60 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as CVE-2023-39583, CVE-2023-40270, GHSA-w5x7-vwr2-4x27.