CVE-2023-38831

Executive Summary

CVE-2023-38831 is a high-severity arbitrary code execution vulnerability in WinRAR versions prior to 6.23. The flaw lies in the ZIP archive extraction logic, where an attacker can craft a malicious archive containing a benign file (e.g., .jpg) alongside a folder with an identical name, causing WinRAR to execute code from the folder when the user attempts to open the benign file. Exploited in the wild from April through October 2023, this vulnerability was added to CISA's Known Exploited Vulnerabilities catalog and carries a CVSS score of 7.8 (High) with an EPSS probability of 97.8%, indicating near-certain active exploitation.

Technical Analysis

The vulnerability originates from improper validation of file paths during ZIP archive preview operations in WinRAR's shell extension (ShellExtension64.dll). When a user attempts to view a benign file inside a ZIP archive (e.g., by double-clicking a .jpg), WinRAR checks the target file name against all item names within the archive. The flawed logic fails to fully validate that the file path points to a real file and not a directory.

The attack mechanism is as follows:

1. Archive Structure: The malicious ZIP contains:

   • A benign file: document.jpg
   • A directory: document.jpg/ containing an executable payload (e.g., script.exe or payload.cmd)

2. Path Comparison Flaw: WinRAR's archive viewer checks if document.jpg exists among items. It detects both the file and the directory (which shares a prefix with a separator). The comparison logic fails to disambiguate between the file and the directory.

3. Execution Path: When the user previews document.jpg, WinRAR extracts and processes the contents of the document.jpg/ folder instead of the actual file. Any executable content inside that folder is launched with the privileges of the logged-in user.

4. Trigger Conditions: The attack requires only that the user opens the archive and double-clicks the decoy file. No additional flags, macros, or user consent are needed beyond standard archive interaction.

The code-level issue involves insufficient filename normalization — WinRAR's CFileInfo::IsDir checks and the archive traversal routine fail to compare full paths with trailing separators, allowing the prefix-match confusion. This is conceptually similar to ZIP-slip path traversal but operates in the reverse direction (directory-to-file confusion instead of file-to-directory escape).

Affected versions: WinRAR 6.22 and earlier, including the trial, commercial, and unRAR SDK versions. Both 32-bit and 64-bit builds are affected.

Exploitation Scenarios

Chain: Phishing Campaign → Malicious ZIP → Code Execution → Initial Access

1. Reconnaissance (Targeted): The attacker profiles the target organization via LinkedIn or corporate websites to identify employees handling financial documents, contracts, or who frequently exchange attachments. Alternatively, a spray campaign uses generic themes (e.g., "invoice", "Q3 report") with broad targeting.

2. Weaponization: The attacker constructs the malicious ZIP:

   • Takes a legitimate benign file, e.g., orders.pdf or invoice.jpg.
   • Creates a folder named invoice.jpg/ in the same archive.
   • Places a trojanized executable or malware loader (e.g., a Cobalt Strike beacon, remote access trojan, or stealer) inside that folder.
   • The executable may be renamed to something innocuous (e.g., data.dat.exe) to avoid suspicion.

3. Delivery: Sends the ZIP via email attachment (most common), or hosts it on file-sharing services or compromised websites for click-based distribution.

4. Exploitation: The user opens the archive; WinRAR displays invoice.jpg as a regular file. The user double-clicks it to preview. The vulnerable code path in ShellExtension64.dll extracts the entire invoice.jpg/ directory contents and executes the payload.

5. Post-Exploitation: The payload runs with the user's privileges. Typical follow-on actions:

   • Download and execute additional dropper payloads.
   • Establish persistent C2 communications.
   • Lateral movement via SMB/WMI/PsExec.
   • Credential harvesting (LSASS dumping, keylogging).

Known Campaign: The March 2023 APT29 campaign leveraged this CVE during trial exploitation phases (reported as CL_AUG_45.war decoys), with active exploitation observed through October 2023.

Impact Assessment

• Confidentiality: High (CVSS C:H) — full user-level file access.
• Integrity: High (CVSS I:H) — arbitrary code execution can modify or delete data.
• Availability: High (CVSS A:H) — malware can disrupt operations or ransack systems.
• Attack Vector: Local (AV:L) — requires the user to interact with a malicious archive.
• Attack Complexity: Low (AC:L) — no special conditions beyond standard archive interaction.
• Privileges Required: None (PR:N) — works on any unprivileged user session.
• User Interaction: Required (UI:R) — the user must double-click the decoy file.

Business Impact: WinRAR is installed on an estimated 500 million+ endpoints globally. Enterprises with legacy software management, restricted internet access for patching, or large archives of downloaded files are at highest risk. The attack surface is substantial — any organization relying on WinRAR for file extraction is exposed. The low technical barrier and confirmed in-the-wild abuse make this a high-priority remediation target.

Detection Guidance

Sigma Rule

title: WinRAR CVE-2023-38831 Exploitation Attempt
id: 27a9e2b3-6c21-4d9e-8d5f-aa472f0bc4d1
status: experimental
description: Detects failed WinRAR extraction with suspicious directory-file path confusion or execution of payloads from archive directories.
author: ValtersIT TRT
logsource:
  category: process_creation
  product: windows
detection:
  selection_winrar:
    Image|endswith: '\WinRAR.exe'
  selection_shell_ext:
    Image|endswith: '\ShellExtension64.dll'
  selection_susp_sibling:
    CommandLine|contains:
      - '*.jpg*'
      - '*.pdf*'
      - '*.docx*'
  filter_clean:
    CommandLine|contains|all:
      - '/p'
      - '-p'
  condition: selection_winrar and selection_shell_ext and selection_susp_sibling and not filter_clean
falsepositives:
  - Legitimate archives containing files and folders with similar names
level: high
tags:
  - attack.t1203
  - attack.execution
  - cve.2023-38831

YARA Rule

rule CVE_2023_38831_WinRAR_Exploit {
    meta:
        description = "Detects crafted ZIP archives exploiting WinRAR path confusion"
        author = "ValtersIT TRT"
        date = "2023-08-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-38831"
        hash = "unknown"
    strings:
        $zip_magic = { 50 4B 03 04 }
        $file_hdr = { 50 4B 01 02 }
        $jpg_ext = ".jpg" ascii
        $pdf_ext = ".pdf" ascii
        $png_ext = ".png" ascii
        $exe_ext = ".exe" ascii
        $cmd_ext = ".cmd" ascii
        $bat_ext = ".bat" ascii
        $dir_sep = "/" ascii
        $file_name_now = "document"
        $folder_name = "document/"

    condition:
        uint32(0) == 0x04034B50 and 
        (any of them) and 
        (#file_name_now > 1) and 
        ($dir_sep at 0 and $file_name_now in (0..1024))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-38831 WinRAR ZIP Shipped Over HTTP"; flow:to_server,established; http.header; content:"application/zip"; http.header_names; pcre:"/(?i)\.(zip|rar)$/"; file_data; content:"PK\x03\x04"; within:4; reference:cve,2023-38831; metadata:author ValtersIT TRT; classtype:attempted-user; sid:1000561; rev:1;)

Elastic Detection

sequence by process.entity_id
  with maxspan=5s
  [process where event.code == "1" and
   process.name : "WinRAR.exe" and
   process.parent.name : "explorer.exe"]
  [process where event.code == "1" and
   process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe") and
   process.parent.name : "*WinRAR*"]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| search EventCode=4688 Process_Name="*WinRAR.exe*"
| rex field=New_Process_Name "(?<exe>.+(?i:exe|cmd|bat|ps1))"
| where exe != ""
| stats count by host, User, Process_Name, New_Process_Name, Parent_Process
| where count > 1

Wazuh OSSEC Rule

<group name="process,execution,">
    <rule id="100120" level="12">
        <if_sid>5715</if_sid>
        <match>WinRAR.exe</match>
        <match>cmd.exe|powershell.exe|wscript.exe</match>
        <description>CVE-2023-38831: Suspicious child process from WinRAR extraction</description>
        <mitre>
            <tactic id="TA0002">Execution</tactic>
            <technique id="T1203">Client Execution</technique>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — single source (NVD) claims patch in WinRAR 6.23; not independently confirmed.

Immediate Mitigations (before patching):

1. Upgrade immediately to WinRAR 6.23 or later — this is the only reliable mitigation.
2. If upgrading is not immediately feasible, configure WinRAR settings to disable preview in the shell extension:
   • Open WinRAR → Settings → General → Uncheck "Shell integration" → OK.
   • This prevents the flawed code path from being triggered by Windows Explorer previews.
3. Re-train users to never open archives from untrusted sources and to extract to a sandboxed directory before viewing contents.

Patch/Upgrade Steps:

1. Download WinRAR 6.23 or newer from the official site: https://www.rarlab.com/download.htm.
2. For enterprise deployments, replace all localized and x86/x64 versions.
3. Verify integrity via the provided checksums.
4. Test extraction of both ZIP and RAR archives for regression issues.

Long-term Hardening:

• Implement application allowlisting to block WinRAR from spawning child processes (e.g., SRP, AppLocker).
• Enable Windows Defender Exploit Guard — ASR rules to block process creations from archive handlers.
• Monitor CISA KEV catalog (remediation date: 2023-09-14) and patch within that window.
• Consider migrating to open-source archivers with active security programs (e.g., 7-Zip) if WinRAR support cadence is insufficient.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-38831
2. RARLAB Official: https://www.rarlab.com/rarnew.htm
3. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
4. Researcher Analysis (Google Threat Analysis Group, March 2023): https://blog.google/threat-analysis-group/
5. Exploit-DB / Public PoC: https://www.exploit-db.com/exploits/51992