WinRAR Vulnerability Allows Arbitrary Code Execution
Key Information
- Vendor
- Rarlab
- Status
- Winrar
- Vendor
- CVE Published:
- 23 August 2023
Badges
Summary
A critical vulnerability, tracked as CVE-2023-38831, has been identified in WinRAR software, allowing attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. This vulnerability has been exploited in the wild from April through October 2023. The Bumblebee malware loader has reemerged in a campaign targeting thousands of US organizations, using a new attack vector to deliver various payloads. This marks a surge in cybercriminal threat activity and requires organizations to be vigilant for malicious email campaigns. Moreover, a new Windows Defender zero-day, CVE-2024-21412, was exploited by a financially motivated threat group to deploy the DarkMe remote access trojan, targeting foreign exchange traders with the likely end goal of data theft or ransomware deployment. It is critical for organizations to stay updated on these vulnerabilities and maintain strong security practices to avoid exploitation.
CISA Reported
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-38831 as being exploited and is known by the CISA as enabling ransomware campaigns.
The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
Russian researchers say espionage operation using WinRAR bug is linked to Ukraine
Moscow-based F.A.C.C.T. said it found what appears to be a Ukraine-based campaign exploiting a vulnerability that other cyber-espionage operations have leveraged elsewhere.
4 months ago
Russia and China-linked hackers exploit WinRAR bug
Hackers connected to the governments of Russia and China are allegedly using a vulnerability in a popular Windows tool to attack targets around the world, including in Ukraine and Papua New Guinea.
4 months ago
BumbleBee Malware Buzzes Back on the Scene After 4-Month Hiatus
Cyberattacks targeting thousands of US organizations wields a new attack vector to deliver the versatile initial-access loader — and is a harbinger of a surge in threat activity.
7 months ago
EPSS Score
31% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 👾
Exploit exists.
First article discovered by BleepingComputer
Vulnerability published.
Vulnerability Reserved.