Rarlab WinRar up to 5.60 ACE filename path traversal

Summaryinfo

A vulnerability marked as critical has been reported in Rarlab WinRar. Affected is an unknown function of the component ACE Handler. The manipulation of the argument filename leads to input validation. This vulnerability is uniquely identified as CVE-2018-20250. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Rarlab WinRar (File Compression Software). This issue affects an unknown code of the component ACE Handler. The manipulation of the argument filename with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

The bug was discovered 02/05/2019. The weakness was disclosed 02/05/2019 (Website). It is possible to read the advisory at win-rar.com. The identification of this vulnerability is CVE-2018-20250 since 12/19/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

A public exploit has been developed by WYATU in Python and been published 3 weeks after the advisory. The exploit is available at exploit-db.com. It is declared as attacked. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371635 (WinRAR Arbitrary Code Execution Vulnerability). The CISA Known Exploited Vulnerabilities Catalog lists this issue since 02/15/2022 with a due date of 08/15/2022:

Apply updates per vendor instructions.

Upgrading to version 5.70 beta 1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (46552) and SecurityFocus (BID 106948†). The entries VDB-130548, VDB-130549 and VDB-130837 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• File Compression Software

Vendor

• Rarlab

Name

• WinRar

Version

• 2.90
• 3.0.0
• 3.10
• 3.10 Beta3
• 3.10 Beta5
• 3.11
• 3.20
• 3.30
• 3.40
• 3.41
• 3.42
• 3.50
• 3.51
• 3.60
• 3.60 Beta8
• 3.62
• 5.7
• 5.30 Beta 4
• 5.60

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion