WinRAR Absolute Path Traversal Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-02-15
• Known to be used in ransomware campaigns
• EPSS: 96% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

CISA: WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Aug 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-C…ExploitThird Party AdvisoryVDB Entry
• www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_aceThird Party Advisory
• www.securityfocus.com/bid/106948Broken LinkThird Party AdvisoryVDB Entry
• github.com/blau72/CVE-2018-20250-WinRAR-ACEExploitThird Party Advisory
• research.checkpoint.com/extracting-code-execution-from-winrarExploitPress/Media CoverageThird Party Advisory
• www.exploit-db.com/exploits/46552ExploitThird Party AdvisoryVDB Entry
• www.exploit-db.com/exploits/46756ExploitThird Party AdvisoryVDB Entry
• www.win-rar.com/whatsnew.htmlRelease Notes
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource