CVE-2023-38831

CVE-2023-38831: WinRAR ZIP Extension Spoofing Leads to Arbitrary Code Execution

AI-generated analysis based on the vulnerability data on this page.

Summary

WinRAR before version 6.23 is vulnerable to an extension-spoofing attack inside ZIP archives. An attacker can craft a ZIP file that contains both an innocent-looking file (e.g., a .jpg) and a folder sharing the exact same name. When the victim double-clicks the benign file to preview it, WinRAR mistakenly processes the folder contents—potentially launching an executable script—instead of the image. This vulnerability was exploited in the wild between April and October 2023.

Background

WinRAR is a widely deployed file archiver for Windows, with hundreds of millions of users. Its built-in preview feature lets users open files inside archives without extracting them first. The vulnerability stems from how WinRAR resolves file paths when a file and a folder share the same name inside a ZIP archive.

Root Cause

The weakness maps to CWE-345: Insufficient Verification of Authenticity. WinRAR does not adequately validate that the file extension of the item being previewed matches the actual content being executed. When a ZIP entry contains both document.jpg and a folder named document.jpg/, WinRAR's path-resolution logic can be tricked into processing the folder contents (which may include .bat, .cmd, or .exe files) rather than the benign image. The archive structure effectively impersonates a safe file type while delivering malicious content.

Impact

With a CVSS v3 score of 7.8 (HIGH), the confidentiality, integrity, and availability impacts are all rated HIGH. The vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates:

• Attack Vector (AV): Local — requires user interaction
• Attack Complexity (AC): Low — trivial to construct the archive
• Privileges Required (PR): None — runs with user privileges
• User Interaction (UI): Required — victim must open the file
• Scope (S): Unchanged
• Confidentiality/Integrity/Availability (C/I/A): All HIGH

An attacker can achieve arbitrary code execution with the victim's privileges, leading to full system compromise, data theft, or further lateral movement.

Exploitation Walkthrough

This section is provided for defensive awareness only. No weaponized exploit code is included.

1. Archive Preparation: The attacker creates a ZIP archive containing a benign file (e.g., statement.pdf) alongside a folder named statement.pdf/. Inside the folder, the attacker places a malicious script or executable.
2. Social Engineering: The archive is delivered via email, forum post, or download site, often themed around trading, finance, or urgent documents.
3. User Action: The victim opens the archive in WinRAR and double-clicks what appears to be statement.pdf to preview it.
4. Execution: Due to path-resolution confusion, WinRAR processes the folder contents rather than the PDF, executing the attacker's payload.
5. Post-Exploitation: The attacker may install backdoors, steal credentials, or move laterally within the network.

Ethics caveat: Attempting to recreate this attack against systems you do not own or have explicit permission to test is illegal in most jurisdictions.

Affected and Patched Versions

• Affected: RARLAB WinRAR before 6.23
• Patched: WinRAR 6.23 and later

The vulnerable CPE is cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*.

Remediation

1. Upgrade immediately to WinRAR 6.23 or later from the official RARLAB website.
2. Compensating controls:
   • Block or quarantine ZIP attachments at email gateways, especially those containing nested folders that mimic file names.
   • Restrict software execution from temporary directories (e.g., AppData\Local\Temp) using AppLocker or Windows Defender Application Control (WDAC).
   • Train users to extract archives to a designated folder and inspect contents with a file manager before opening any file.
   • Disable preview features in archive utilities where possible.

Detection

• File indicators: Look for ZIP archives containing files and folders with identical names (e.g., invoice.pdf and invoice.pdf/).
• Behavioral indicators: Monitor for unexpected process execution spawned by WinRAR.exe, especially child processes like cmd.exe, powershell.exe, or wscript.exe.
• Network indicators: Review proxy and firewall logs for outbound connections initiated shortly after WinRAR is opened, especially to known trading or financial platforms (this was a common targeting theme).
• Endpoint detection: Use EDR rules that flag execution from WinRAR's temporary extraction paths.

Assessment

This vulnerability carries an EPSS score of 0.97798 (99.9th percentile), reflecting near-certain active exploitation. It has been listed in CISA's Known Exploited Vulnerabilities (KEV) catalog since 2023-08-24 and in the EU Vulnerability Database (EUVD-2023-42604) with the same date. Google's Threat Analysis Group and Group-IB both reported widespread exploitation targeting traders and financial institutions.

Key lessons:

1. File-type validation must be strict and content-aware, not merely extension-based. Archive tools that preview files before extraction are high-value targets for extension-spoofing attacks.
2. Rapid patching is critical for client-side software. Despite WinRAR's auto-update mechanism, many organizations remain on older versions because they are not centrally managed. Software asset management and patch orchestration for third-party utilities are essential security controls.

References

• http://packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html
• https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/
• https://news.ycombinator.com/item?id=37236100
• https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/
• https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38831