RARLAB · WinRAR
The flaw lies in RARLAB WinRAR before version 6.23, where WinRAR processes the contents of a folder inside a ZIP archive when a user attempts to open a benign-looking file that shares the folder's name. An attacker who can get a user to open such a crafted ZIP archive in WinRAR can execute arbitrary code, provided the user takes an action to view the benign file and no authentication is required.
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.
First seen exploited 44 days before it was disclosed. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2023-38831 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…providers such as Private Internet Access, Windscribe, Express VPN, NordVPN, and Urban VPN Acquire Infrastructure T1583 ASA has obtained operational servers from its cover-hosting resellers (server-speed[.]com and more recently vps-agent[.]net) Develop Capabilities T1587 Weaponization of CVE 2023-38831…
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.