WinRAR Arbitrary Code Execution Vulnerability (CVE-2023-38831) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-38831) is a logical flaw in the file expansion and path validation logic of RARLAB WinRAR. When WinRAR processes a ZIP archive, it fails to properly isolate file execution from directory structures with matching names (CWE-345, CWE-351). If an archive contains a benign file alongside a directory sharing the exact same base name, WinRAR inadvertently extracts and processes the contents of that directory during the execution attempt of the benign file.

2. Exploitation Mechanics & Attack Scenario

An attacker crafts a malicious ZIP archive containing a benign file (e.g., 'document.pdf') and a folder named identically with a trailing space (e.g., 'document.pdf '). Inside this folder, the attacker places a malicious executable or script (e.g., 'document.pdf .cmd'). When the victim double-clicks 'document.pdf' within the WinRAR GUI, WinRAR's internal extraction routine extracts both the file and the matching folder to a temporary directory. Due to parameter expansion and ShellExecute behavior on Windows, the operating system executes the malicious script from the folder instead of opening the intended PDF file.

3. Infrastructure & Business Impact

This vulnerability was actively exploited in the wild as a zero-day from April through October 2023, targeting financial trading accounts and government entities. Successful exploitation allows remote threat actors to gain initial access, execute arbitrary payloads, and establish persistence on corporate endpoints, posing severe risks of data exfiltration, ransomware deployment, and lateral movement within the internal network.