WinRAR Vulnerability Allows Arbitrary Code Execution
CVE-2023-38831
Key Information:
- Vendor
- Rarlab
- Status
- Winrar
- Vendor
- CVE Published:
- 23 August 2023
Badges
Summary
A critical vulnerability, tracked as CVE-2023-38831, has been identified in WinRAR software, allowing attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. This vulnerability has been exploited in the wild from April through October 2023. The Bumblebee malware loader has reemerged in a campaign targeting thousands of US organizations, using a new attack vector to deliver various payloads. This marks a surge in cybercriminal threat activity and requires organizations to be vigilant for malicious email campaigns. Moreover, a new Windows Defender zero-day, CVE-2024-21412, was exploited by a financially motivated threat group to deploy the DarkMe remote access trojan, targeting foreign exchange traders with the likely end goal of data theft or ransomware deployment. It is critical for organizations to stay updated on these vulnerabilities and maintain strong security practices to avoid exploitation.
CISA Reported
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited and is known by the CISA as enabling ransomware campaigns.
The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
Get notified when SecurityVulnerability.io launches alerting 🔔
Well keep you posted 📧
News Articles
Russian researchers say espionage operation using WinRAR bug is linked to Ukraine
Moscow-based F.A.C.C.T. said it found what appears to be a Ukraine-based campaign exploiting a vulnerability that other cyber-espionage operations have leveraged elsewhere.
8 months ago
Russia and China-linked hackers exploit WinRAR bug
Hackers connected to the governments of Russia and China are allegedly using a vulnerability in a popular Windows tool to attack targets around the world, including in Ukraine and Papua New Guinea.
8 months ago
BumbleBee Malware Buzzes Back on the Scene After 4-Month Hiatus
Cyberattacks targeting thousands of US organizations wields a new attack vector to deliver the versatile initial-access loader — and is a harbinger of a surge in threat activity.
11 months ago
References
EPSS Score
45% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 💰
Used in Ransomware
- 👾
Exploit known to exist
- 🦅
CISA Reported
- 📰
First article discovered by BleepingComputer
Vulnerability published
Vulnerability Reserved