CVE-2024-30370

Executive Summary

CVE-2024-30370 is a Mark-of-the-Web (MOTW) bypass vulnerability in RARLAB WinRAR. The flaw resides in the archive extraction functionality, where a crafted archive entry can create an arbitrary file without the MOTW attribute. This allows an attacker to bypass Windows security protections that rely on MOTW, such as SmartScreen and Protected View in Office applications. User interaction is required (e.g., opening a malicious archive and extracting a file). While the CVSS score is 4.3 (Medium), the impact is amplified when chained with other vulnerabilities, potentially leading to arbitrary code execution. No public exploit or patch details are available at this time.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is specific to the WinRAR desktop application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely via a malicious archive.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The user must extract a file from the archive.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: Low (I:L) – MOTW bypass allows files to be created without security markings.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The MOTW bypass alone is limited, but it can be chained with other exploits (e.g., CVE-2024-30371) to achieve code execution.

Deep Dive & Mechanics

The Mark-of-the-Web (MOTW) is a Windows security feature that adds an alternate data stream (ADS) named Zone.Identifier to files downloaded from the internet. This stream contains a zone ID (e.g., 3 for Internet) that triggers additional security checks (e.g., SmartScreen, Protected View).

WinRAR’s extraction process fails to propagate the MOTW from the archive to extracted files when a specially crafted archive entry is used. The vulnerability lies in how WinRAR handles archive entries with specific attributes or names that cause the MOTW to be omitted during extraction.

Attack Flow:

1. Attacker creates a malicious archive (e.g., RAR, ZIP) containing a crafted entry.
2. The crafted entry is designed to bypass WinRAR’s MOTW propagation logic.
3. Victim downloads the archive (MOTW is applied to the archive file itself).
4. Victim extracts the archive using WinRAR.
5. The extracted file is created without the MOTW ADS.
6. If the extracted file is an executable or a document, it will not be subject to SmartScreen or Protected View, increasing the likelihood of successful exploitation.

Root Cause: Improper handling of file attributes or metadata during extraction, leading to the omission of the MOTW ADS.

Vulnerable vs. Patched Code

No official patch or patched code is available. The vulnerability is unpatched as of the latest advisory. The following is a conceptual comparison:

Vulnerable Code (WinRAR extraction logic):

// Pseudocode for vulnerable extraction
void ExtractFile(ArchiveEntry entry) {
    // Create file without MOTW propagation
    HANDLE hFile = CreateFile(entry.Name, ...);
    WriteFile(hFile, entry.Data, ...);
    CloseHandle(hFile);
    // MOTW is not copied from archive
}

Patched Code (Expected fix):

// Pseudocode for patched extraction
void ExtractFile(ArchiveEntry entry) {
    HANDLE hFile = CreateFile(entry.Name, ...);
    WriteFile(hFile, entry.Data, ...);
    CloseHandle(hFile);
    // Copy MOTW from archive to extracted file
    CopyMOTW(entry.ArchivePath, entry.Name);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WinRAR (any version prior to patch)
• A malicious archive with a crafted entry

Steps:

1. Create a malicious archive using a tool like rar or zip with a crafted entry that bypasses MOTW.
2. Host the archive on a web server or deliver via email.
3. Victim downloads and extracts the archive.
4. The extracted file (e.g., malicious.exe) will lack MOTW, bypassing SmartScreen.

Example Crafted Archive (using Python):

import zipfile
import os

# Create a malicious ZIP with a crafted entry
with zipfile.ZipFile('malicious.zip', 'w') as zf:
    # Add a file with a name that triggers the MOTW bypass
    zf.writestr('malicious.exe', b'[malicious code]')
    # Modify internal metadata to bypass MOTW (conceptual)
    # This is a simplified example; actual exploitation requires reverse engineering

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team

Detection:

• Monitor for WinRAR processes creating files without the MOTW ADS.
• Use Sysmon to log file creation events and check for missing Zone.Identifier streams.

Hunting Query (KQL):

DeviceProcessEvents
| where FileName == "WinRAR.exe"
| where ProcessCommandLine contains "x" or ProcessCommandLine contains "e"
| join kind=inner (
    DeviceFileEvents
    | where FileName endswith ".exe" or FileName endswith ".docx"
    | where not (AdditionalFields has "Zone.Identifier")
) on $left.ProcessId == $right.ProcessId

Indicators of Compromise (IOCs)

• File Hashes: None available (no public samples).
• Network Indicators: None specific.
• Behavioral IOCs:
  • WinRAR process creating files without Zone.Identifier ADS.
  • Files extracted from archives that lack MOTW despite the archive having it.

Detection Engineering

YARA Rule

rule CVE_2024_30370_MOTW_Bypass {
    meta:
        description = "Detects WinRAR archives crafted to bypass MOTW"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-30370"
    strings:
        $rar_magic = { 52 61 72 21 1A 07 00 } // RAR magic bytes
        $zip_magic = { 50 4B 03 04 } // ZIP magic bytes
        $motw_ads = "Zone.Identifier"
    condition:
        ($rar_magic or $zip_magic) and not $motw_ads
}

Sigma Rule

title: WinRAR MOTW Bypass via Crafted Archive
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects file creation by WinRAR without MOTW ADS
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\WinRAR.exe'
        TargetFilename|endswith:
            - '.exe'
            - '.docx'
            - '.xlsx'
            - '.pptx'
    filter:
        TargetFilename|contains: 'Zone.Identifier'
    condition: selection and not filter
falsepositives:
    - Legitimate files extracted from trusted sources
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-30370 WinRAR MOTW Bypass - Potential Malicious Archive Download"; flow:to_server,established; content:"|50 4B 03 04|"; depth:4; content:"malicious.exe"; nocase; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable WinRAR or restrict its use until a patch is available.
2. Use alternative archive tools (e.g., 7-Zip) that properly propagate MOTW.
3. Enable Windows Defender Application Guard for untrusted files.

Long-term Fix:

• Apply the official patch from RARLAB when released.
• Implement Group Policy to enforce MOTW checks on all extracted files.

Workaround:

• Manually add MOTW to extracted files using PowerShell:

Set-Content -Path "C:\path\to\file.exe" -Stream Zone.Identifier -Value "[ZoneTransfer]`nZoneId=3"

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Monitor for anomalous file creation by WinRAR.

Valters IT
Securing Digital Frontiers