CVE-2023-38831

What it actually does

This vulnerability is an improper validation flaw in WinRAR ZIP archive handling before version 6.23. A specially crafted ZIP can contain a normal-looking file, such as an image or document, and a directory with the same displayed name. When a user opens or previews the benign-looking file from WinRAR, WinRAR can process content from the similarly named directory and launch attacker-controlled executable content. The result is local arbitrary code execution in the context of the user who opened the archive. Because exploitation requires user interaction but no authentication or privileges, successful attacks commonly begin through phishing, malicious downloads, or messaging attachments.

Why it matters to the business

Successful exploitation can give an attacker the same access as the user who opens the archive, enabling credential theft, malware installation, data theft, lateral movement, and ransomware deployment. This issue is high urgency because it is in CISA KEV, has been exploited in the wild, has a very high EPSS score, and has been associated with ransomware activity; the CISA remediation deadline of 2023-09-14 has long passed. Organizations that allow users to open compressed archives from email, web downloads, or collaboration tools remain at elevated risk, especially because WinRAR is common on endpoints and may be unmanaged or installed outside standard software deployment processes.

How an attack unfolds

An attacker prepares a ZIP archive designed to exploit WinRAR's handling of entries with confusingly similar names. The archive presents a harmless-looking lure file, such as a JPG, PDF, or document, while also containing a directory with a matching name that holds a script, shortcut, or executable payload. The attacker delivers the archive through email, a web download, a file-sharing link, or a messaging platform. When the victim opens the archive in a vulnerable WinRAR version and attempts to view the benign-looking file, WinRAR processes the malicious content associated with the matching directory and runs attacker-controlled code. The payload may establish persistence, steal browser or Windows credentials, leak NTLM material, download additional malware, or hand off access to ransomware operators. Public reporting and KEV status indicate this technique has been used in real-world campaigns, including activity targeting logistics, technology, and credential-theft use cases.

How to fix it

Upgrade WinRAR to version 6.23 or later on all systems where it is installed. Because older WinRAR installations may exist outside managed software inventories, search endpoints for WinRAR.exe and Rar.exe in standard and non-standard installation paths. Remove unused WinRAR installations where business need does not exist. Until all systems are remediated, block or quarantine unsolicited compressed archives, especially ZIP files received from external sources; prevent WinRAR from being the default handler for ZIP files where feasible; and use endpoint controls to block WinRAR from spawning script interpreters or living-off-the-land binaries such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, and regsvr32.exe. Apply attachment sandboxing and content-disarm controls for archive files delivered by email or collaboration platforms.

How to confirm the fix worked

Confirm that every installed WinRAR instance reports version 6.23 or later through application inventory, file version checks on WinRAR.exe and Rar.exe, or the WinRAR Help/About dialog. Validate that no vulnerable copies remain in common paths such as Program Files, Program Files (x86), user profile directories, Downloads folders, portable app directories, or software packaging caches. Review endpoint telemetry to confirm WinRAR is not spawning child processes associated with code execution. If using a controlled benign validation archive, confirm that opening a lure file in the archive does not execute any child process and that endpoint controls generate expected alerts for suspicious WinRAR child-process behavior. Also verify mail gateways and EDR policies detect or quarantine archives with suspicious duplicate file-and-directory naming patterns.

Typical attack path

1. Attacker identifies users likely to open archive attachments or downloaded ZIP files.
2. Attacker creates a crafted ZIP archive containing a lure file and a same-name directory containing malicious executable content.
3. Attacker delivers the archive through phishing email, file-sharing services, collaboration platforms, or compromised websites.
4. User opens the ZIP in a vulnerable WinRAR version before 6.23.
5. User attempts to open or preview the benign-looking file inside the archive.
6. WinRAR mishandles the crafted archive structure and launches attacker-controlled content from the similarly named directory.
7. Malicious payload runs with the user's privileges and may download second-stage malware, steal credentials, or establish persistence.
8. Attacker uses the foothold for data theft, lateral movement, NTLM relay or hash leakage, or ransomware deployment.

How to detect it

To determine whether exploitation already occurred, review endpoint process telemetry, Windows Security Event ID 4688, Sysmon Event ID 1, EDR process trees, email gateway logs, web proxy download logs, and file creation events around the time users opened ZIP archives. Focus on WinRAR.exe or Rar.exe launching unexpected child processes, especially command shells, scripting engines, Microsoft Office, shortcut handlers, LOLBins, or executables from temporary extraction paths. Hunt for archive extraction directories under user temp locations such as Rar$DIa* and Rar$EXa* followed by execution of .exe, .scr, .bat, .cmd, .vbs, .js, .lnk, .hta, .ps1, or .dll files. Correlate with inbound archive attachments, downloads from external file-sharing services, and subsequent credential access, NTLM leakage, persistence, or ransomware behaviors. For affected hosts, preserve the original archive if available, collect process trees, command lines, file creation events, network connections, autoruns, scheduled tasks, registry run keys, browser credential access artifacts, and authentication logs. Threat context includes real-world exploitation by campaigns targeting Western logistics and technology entities and activity involving NTLM relay or hash leakage, so prioritize evidence of outbound SMB/WebDAV authentication attempts and credential theft after archive execution.

• WinRAR.exe spawning cmd.exe
• WinRAR.exe spawning powershell.exe
• WinRAR.exe spawning wscript.exe
• WinRAR.exe spawning cscript.exe
• WinRAR.exe spawning mshta.exe
• WinRAR.exe spawning rundll32.exe
• WinRAR.exe spawning regsvr32.exe
• WinRAR.exe spawning schtasks.exe
• WinRAR.exe spawning bitsadmin.exe
• WinRAR.exe spawning certutil.exe
• Rar.exe spawning cmd.exe
• Rar.exe spawning powershell.exe
• %LOCALAPPDATA%\Temp\Rar$DIa*
• %LOCALAPPDATA%\Temp\Rar$EXa*
• \AppData\Local\Temp\Rar$DIa
• \AppData\Local\Temp\Rar$EXa
• WinRAR.exe child process executing from \AppData\Local\Temp\Rar$
• Rar.exe child process executing from \AppData\Local\Temp\Rar$
• .zip archive containing a file and directory with the same displayed name
• .zip archive containing executable content under a directory named like a visible lure file
• Sysmon Event ID 1 Image=WinRAR.exe ParentImage=explorer.exe
• Windows Security 4688 New Process Name=WinRAR.exe
• Process command line contains \Temp\Rar$DIa
• Process command line contains \Temp\Rar$EXa
• FileCreate in \AppData\Local\Temp\Rar$DIa with extension .lnk
• FileCreate in \AppData\Local\Temp\Rar$DIa with extension .cmd
• FileCreate in \AppData\Local\Temp\Rar$DIa with extension .bat
• FileCreate in \AppData\Local\Temp\Rar$DIa with extension .vbs
• FileCreate in \AppData\Local\Temp\Rar$DIa with extension .js
• FileCreate in \AppData\Local\Temp\Rar$DIa with extension .hta
• FileCreate in \AppData\Local\Temp\Rar$DIa with extension .scr

What your security team should do

• Immediately inventory all endpoints and servers for WinRAR installations and prioritize upgrades to 6.23 or later; treat any remaining pre-6.23 install as actively exploitable.
• Because this is a KEV-listed and ransomware-associated vulnerability with a past due remediation deadline, escalate remediation as an emergency endpoint hygiene item rather than a routine software update.
• Hunt for WinRAR.exe or Rar.exe spawning script interpreters, command shells, LOLBins, or unknown executables, especially from temporary extraction directories.
• Search email, web proxy, EDR, and file-share telemetry for ZIP archives delivered before or shortly after suspicious WinRAR process activity.
• Block or alert on compressed archive attachments with duplicate file and directory names, trailing-space name tricks, or executable content hidden behind document/image lures.
• Add EDR prevention rules that restrict WinRAR child processes to expected viewers and block execution of cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, and arbitrary files from WinRAR temporary directories.
• Perform credential-theft and ransomware follow-on hunting on any endpoint where suspicious WinRAR execution is observed, including browser credential access, LSASS access, persistence creation, and outbound command-and-control traffic.
• Educate users and help desks that archive files can execute malware even when the visible file appears to be a harmless image or document.