CVE-2023-38831
RARLAB WinRAR Code Execution Vulnerability
Description
CVE-2023-38831 is a high-severity arbitrary code execution vulnerability in RARLAB WinRAR before version 6.23. The flaw exploits insufficient verification of data authenticity when a user attempts to view a benign file within a ZIP archive. An attacker can craft a ZIP archive containing a harmless-looking file alongside a folder with the same name that holds executable content, causing WinRAR to process the malicious folder contents instead of the expected file. CVE-2023-38831 was actively exploited as a zero-day from April through October 2023, and CISA has confirmed its use in ransomware campaigns, making it a critical threat requiring immediate patching of WinRAR installations.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| rarlab | winrar | < 6.23 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/(Exploit, Third Party Advisory)
- https://news.ycombinator.com/item?id=37236100(Issue Tracking)
- https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/(Exploit, Press/Media Coverage, Third Party Advisory)
- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/(Exploit, Press/Media Coverage, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38831(US Government Resource)
Weakness Type
CWE-345: Insufficient Verification of Data Authenticity
CWE-345 describes a weakness where software does not sufficiently verify the origin or authenticity of data, allowing an attacker to provide manipulated data that the application treats as legitimate. In CVE-2023-38831, WinRAR fails to properly verify that the file being accessed within a ZIP archive actually corresponds to the intended benign file, rather than a same-named folder containing malicious executable content.
Learn more: CWE-345 — Insufficient Verification of Data Authenticity
CWE-351: Insufficient Type Distinction
CWE-351 occurs when software does not properly distinguish between different types of elements, leading to incorrect processing. In the context of CVE-2023-38831, WinRAR fails to distinguish between a regular file and a folder that shares the same name within a ZIP archive, causing it to process the folder's executable contents when the user intends to open only the benign file.
Learn more: CWE-351 — Insufficient Type Distinction
Impact Analysis
CVE-2023-38831 carries a CVSS v3.1 score of 7.8 (High), indicating significant risk when exploited. The attack vector is local, meaning the user must download and interact with a malicious ZIP archive, and user interaction is required to trigger the exploit by attempting to view a file within the archive. However, no special privileges or authentication are needed, and the attack complexity is low — the attacker simply needs to craft a ZIP file with the right structure. Confidentiality (High): successful exploitation grants the attacker access to all data accessible to the user, including documents, credentials, and browser data. Integrity (High): arbitrary code execution allows installation of malware, backdoors, or modification of system files. Availability (High): the attacker can disrupt the user's system, encrypt files for ransom, or render applications inoperable. The EPSS score of 93.8% (99.86th percentile) indicates near-certain exploitation activity, and CISA has confirmed this vulnerability is used in ransomware campaigns, significantly elevating the real-world risk.
Exploit Maturity
Public exploit code is available for CVE-2023-38831, including a proof-of-concept published on Packet Storm Security. The vulnerability was exploited as a zero-day in the wild from April through October 2023, with detailed analyses published by Google Threat Analysis Group and Group-IB, documenting its use by government-backed threat actors. CISA has confirmed active exploitation and listed it in the Known Exploited Vulnerabilities catalog with a remediation deadline of September 14, 2023, with known ransomware usage. The EPSS score of 93.8% confirms near-certain exploitation probability, consistent with the broad availability of exploit code and its adoption by both state-sponsored and financially motivated threat actors.
Remediation
- Update WinRAR to version 6.23 or later immediately to address the CVE-2023-38831 vulnerability, as directed by CISA's KEV required action and RARLAB's security advisory.
- Block or quarantine ZIP archives at email gateways and web proxies that contain executable files or suspicious structures, particularly archives where files and folders share identical names, to reduce the delivery of exploit payloads.
- Implement application whitelisting and execution controls using tools like Windows Defender Application Control (WDAC) or AppLocker to prevent unauthorized executables from running, even if a user inadvertently triggers a malicious archive.
- Review systems for indicators of compromise including unexpected process executions originating from temporary directories where WinRAR extracts files, suspicious scheduled tasks, and network connections to known command-and-control infrastructure associated with WinRAR exploitation campaigns.
- Educate users about archive file risks and establish policies requiring caution when opening ZIP archives from untrusted sources, emphasizing that this vulnerability can make malicious files appear as harmless images or documents within the archive.
Technical Details
CVE-2023-38831 exploits two related weaknesses in RARLAB WinRAR's ZIP archive handling: insufficient verification of data authenticity (CWE-345) and insufficient type distinction (CWE-351). The attack works by crafting a ZIP archive that contains both a benign file (such as a .JPG image) and a folder with an identical name. When the user double-clicks the benign file to view it, WinRAR incorrectly processes the contents of the same-named folder, which can include executable content such as scripts or batch files. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that the attack requires local interaction — the victim must open the crafted archive and click on the decoy file — but the complexity is low since no special conditions are needed beyond the crafted ZIP structure. The scope is unchanged, meaning the code executes within the user's security context, but since most desktop users have broad access to their own files and network resources, the practical impact of arbitrary code execution is severe.
Frequently Asked Questions
Is CVE-2023-38831 being actively exploited?
Yes, CVE-2023-38831 has been extensively exploited in the wild. It was used as a zero-day vulnerability from April through October 2023 by government-backed threat actors and cybercriminal groups. CISA has confirmed active exploitation and its use in ransomware campaigns, with an EPSS score of 93.8% indicating near-certain exploitation activity.
What products are affected by CVE-2023-38831?
CVE-2023-38831 affects RARLAB WinRAR versions prior to 6.23. All earlier versions of WinRAR that handle ZIP archives are vulnerable. Users should update to WinRAR 6.23 or later to mitigate the arbitrary code execution risk.
How do I fix CVE-2023-38831?
Update WinRAR to version 6.23 or later immediately. In environments where immediate updates are not possible, implement email gateway filtering to block suspicious ZIP archives and deploy application execution controls to prevent unauthorized code from running. Monitor systems for signs of compromise if the vulnerability window was open.
How severe is CVE-2023-38831?
CVE-2023-38831 is rated High severity with a CVSS v3.1 score of 7.8 out of 10. While it requires user interaction to trigger, the attack is simple to execute and results in arbitrary code execution. Its confirmed use in ransomware campaigns and by state-sponsored actors, combined with an EPSS score in the 99.86th percentile, makes it one of the most dangerous actively exploited vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.