Exploiting CVE-202 A Deep Dive

Exploiting CVE-202 presents a significant threat to systems running vulnerable WinRAR versions. This critical arbitrary code execution flaw, officially tracked as CVE-2023-38831, impacts millions of users globally. Threat actors have actively exploited this vulnerability since April 2023, months before its public disclosure.

What the Vulnerability Is and Its Impact

CVE-2023-38831 is a high-severity arbitrary code execution vulnerability in WinRAR. It affects all WinRAR versions prior to 6.23. The National Institute of Standards and Technology (NIST) assigned it a CVSS v3.1 Base Score of 7.8, categorizing it as High severity. The vulnerability allows attackers to execute arbitrary code on a victim's system. This occurs when a user attempts to view a seemingly benign file within a specially crafted ZIP or RAR archive. This can lead to full system compromise, data theft, and further network infiltration. Financially motivated threat actors and government-backed hacking groups have leveraged this flaw.

Affected Versions and Vendor Advisory

• Affected Software: WinRAR versions before 6.23.
• First Patched Version: WinRAR 6.23.
• Vendor Advisory: RARLAB released WinRAR 6.23 to address this vulnerability. Users should refer to the official RARLAB news section for detailed updates.

Technical Root Cause Analysis

The root cause of CVE-2023-38831 lies in WinRAR's improper handling of file extensions within archives. This logical flaw occurs during the processing of ZIP archives. WinRAR exhibits extraneous temporary file expansion. This combines with a quirk in Windows' ShellExecute function when attempting to open a file with an extension containing spaces. Specifically, when an archive contains a benign file (e.g., image.jpg) and a folder with the exact same name (e.g., image.jpg/), WinRAR's extraction process becomes confused. It extracts both the benign file and the contents of the identically named folder to a temporary directory. When the user then double-clicks the seemingly harmless image.jpg, WinRAR invokes ShellExecute. If a malicious executable (e.g., image.jpg.cmd) resides within the image.jpg/ folder, ShellExecute may execute the malicious file instead of the intended image.

Windows' ShellExecute function can interpret paths with trailing spaces or unusual extensions in an unexpected way. WinRAR passes the non-normalized path, including trailing spaces, to ShellExecuteExW. This leads to ShellExecute prioritizing an executable with a different, but similarly named, extension if it exists in the temporary directory.

Exploitation Mechanics

Exploiting CVE-2023-38831 involves a deceptive archive structure. An attacker crafts a malicious ZIP or RAR archive. This archive contains two key components:

1. A decoy file with a common, harmless extension (e.g., document.pdf, photo.jpg). This file often has a trailing space in its name, which is not visible to the user in WinRAR's interface.
2. A folder with the exact same name as the decoy file, including any trailing spaces. Inside this folder, the attacker places a malicious executable (e.g., document.pdf.cmd, photo.jpg.exe).

When a victim opens this specially crafted archive with a vulnerable WinRAR version and double-clicks the seemingly safe decoy file, the exploitation chain begins. WinRAR extracts both the decoy file and the contents of the identically named folder to a temporary location. Due to the vulnerability, Windows' ShellExecute then executes the malicious file from within the folder, rather than opening the benign decoy file. The malicious script typically runs minimized, installing malware in the background. This gives the attacker remote control over the victim's system. Common payloads include information stealers, remote access Trojans (RATs) like DarkMe, GuLoader, and Remcos RAT.

Attackers frequently distribute these malicious archives via phishing campaigns. They often target specific sectors, such as financial traders, by posting weaponized ZIP archives on trading forums. These posts often masquerade as legitimate documents containing strategies or advice.

Detection: How to Check if You're Affected

Organizations must proactively detect and mitigate the risk from CVE-2023-38831. Start by identifying all systems running WinRAR. Check the installed version number. Any version prior to 6.23 is vulnerable. Users can verify their WinRAR version by navigating to "Help" and then "About WinRAR" within the application.

Endpoint Detection and Response (EDR) solutions are crucial. Configure EDR to monitor for suspicious process creation. Look for unexpected execution of command-line interpreters (cmd.exe, powershell.exe) or scripting engines (wscript.exe, cscript.exe) originating from WinRAR's temporary directories. Specifically, monitor for processes launched by WinRAR that do not match expected file types.

Network monitoring can identify post-exploitation activity. Watch for unusual outbound connections from compromised endpoints. This includes C2 (Command and Control) communications. Integrating threat intelligence feeds helps detect known malicious IP addresses or domains associated with WinRAR exploits. For broader attack surface visibility, consider external scanning tools like Zondex. It helps identify exposed services that could serve as initial access points for delivering such archives.

Email gateway security is a primary defense layer. Implement robust filtering for suspicious attachments. Scrutinize all incoming archives. Look for double extensions, unusual file sizes, or unexpected file types within archives. Train users to report suspicious emails and attachments.

Secably offers various tools that contribute to overall security posture, indirectly aiding in the defense against such client-side vulnerabilities. Our free website vulnerability scanner and CMS vulnerability scanner help secure web-facing assets. Attackers often use compromised websites or web applications as distribution points for malicious files. Keeping your web infrastructure hardened reduces these potential vectors. While Secably's focus is on external attack surface management, a strong overall security posture reduces opportunities for attackers. Secably also offers paid monitoring plans starting at $19/month for continuous vulnerability scanning and attack surface insights. For more information on securing systems, read our blog post: Deep Dive into Actively Exploited Vulnerabilities.

Remediation Steps

Immediate action is necessary to mitigate CVE-2023-38831. Prioritize patching all vulnerable WinRAR installations.

1. Update WinRAR: Upgrade WinRAR to version 6.23 or later. This version contains the fix for CVE-2023-38831. Distribute this update enterprise-wide using your patch management solutions.
2. User Education: Conduct regular security awareness training. Emphasize the dangers of opening unsolicited attachments. Instruct users to verify the sender and content of any archive file before opening it. Advise extreme caution with files from untrusted sources.
3. Email and Endpoint Security: Deploy and maintain advanced email filtering solutions. These should detect and block malicious attachments. Ensure endpoint protection platforms (EPP) and EDR solutions are up-to-date. Configure them for maximum detection and prevention capabilities.
4. Least Privilege: Enforce the principle of least privilege. Limit user accounts to standard privileges instead of administrator rights. This reduces the impact of successful exploitation.
5. System Hardening: Apply all operating system and application security patches promptly. Maintain an up-to-date inventory of all software. This ensures no outdated or vulnerable applications remain on endpoints.

Timeline of Disclosure

The timeline surrounding CVE-2023-38831 highlights the threat of zero-day exploitation.

• April 2023: Threat actors began actively exploiting this vulnerability as a zero-day. They targeted financial traders and government entities.
• July 10, 2023: Group-IB Threat Intelligence unit discovered the previously unknown vulnerability. This occurred during research into the DarkMe malware campaign.
• July 12, 2023: Group-IB attempted to contact MITRE Corporation to request a CVE assignment.
• July 20, 2023: RARLAB released a beta version of the patch.
• August 2, 2023: RARLAB released the final updated version, WinRAR 6.23, which fixed the vulnerability.
• August 15, 2023: MITRE Corporation officially assigned the ID CVE-2023-38831 to the vulnerability.
• August 23, 2023: Group-IB publicly disclosed their findings. NIST also officially disclosed the vulnerability.
• August 24, 2023: CISA added CVE-2023-38831 to its Known Exploited Vulnerabilities (KEV) catalog.