PT-2023-4552 · Winrar · Winrar

Andrey Polovinkin · Published 2023-08-15 · Updated 2026-03-10 · CVE-2023-38831

Positive Technologies · (AI Summary)

CVSS v2.0

10

High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WinRAR versions prior to 6.23

Description WinRAR versions prior to 6.23 contain a vulnerability that allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. This occurs because a ZIP archive can include a benign file (such as a .JPG) and a folder with the same name, and the contents of the folder (which may include executable content) are processed when the benign file is accessed. This vulnerability has been actively exploited by multiple threat actors, including Russian and Chinese state-sponsored groups, and has been used in attacks targeting various sectors, including cryptocurrency traders and government organizations. Attackers have used this vulnerability to deliver malware such as Remcos RAT, Agent Tesla, and Asyncshell. The exploitation often involves phishing campaigns with malicious RAR archives. The vulnerability has been exploited since April 2023.

Recommendations Update WinRAR to the latest version to address the vulnerability.

Exploit

Fix

RCE

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-351

CWE-20

CWE-345

Related Identifiers

BDU:2023-04958

CVE-2023-38831

Affected Products

Winrar

References · 477

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/winrar_cve_2023_38831.rb · Exploit
• 🔥 https://github.com/b1tg/CVE-2023-38831-winrar-exploit · Exploit
• 🔥 https://github.com/Garck3h/cve-2023-38831 · Exploit
• 🔥 https://github.com/ignis-sec/CVE-2023-38831-RaRCE · Exploit
• 🔥 https://github.com/BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc · Exploit
• 🔥 https://github.com/HDCE-inc/CVE-2023-38831 · Exploit
• 🔥 https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831 · Exploit
• 🔥 https://github.com/Maalfer/CVE-2023-38831_ReverseShell_Winrar-RCE · Exploit
• 🔥 https://github.com/xaitax/WinRAR-CVE-2023-38831 · Exploit
• 🔥 https://github.com/youmulijiang/evil-winrar · Exploit
• 🔥 https://github.com/MorDavid/CVE-2023-38831-Winrar-Exploit-Generator-POC · Exploit
• 🔥 https://github.com/Malwareman007/CVE-2023-38831 · Exploit
• 🔥 https://github.com/ahmed-fa7im/CVE-2023-38831-winrar-expoit-simple-Poc · Exploit
• 🔥 https://github.com/my-elliot/CVE-2023-38831-winrar-expoit-simple-Poc · Exploit
• 🔥 https://github.com/z3r0sw0rd/CVE-2023-38831-PoC · Exploit