Rarlab WinRar prior 5.70 beta 1 ACE Archive UNACEV2.dll validator filename path traversal

Summaryinfo

A vulnerability described as critical has been identified in Rarlab WinRar. Affected by this vulnerability is the function validator in the library UNACEV2.dll of the component ACE Archive Handler. The manipulation of the argument filename as part of Return Value results in path traversal. This vulnerability was named CVE-2018-20251. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in Rarlab WinRar (File Compression Software). Affected is the function validator in the library UNACEV2.dll of the component ACE Archive Handler. The manipulation of the argument filename as part of a Return Value leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A validation function (in WinRAR code) is being called before extraction of ACE archives. The validation function inspects the filename field for each compressed file in the ACE archive. In case the filename is disallow by the validator function (for example, the filename contains path traversal patterns) The extraction operation should be aborted and no file or folder should be extracted. However, the check of the return value from the validator function made too late (in UNACEV2.dll), after the creation of files and folders. It prevent the write operation to the extracted files only.

The bug was discovered 02/05/2019. The weakness was presented 02/05/2019 (Website). The advisory is shared for download at securityfocus.com. This vulnerability is traded as CVE-2018-20251 since 12/19/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 371635 (WinRAR Arbitrary Code Execution Vulnerability).

Upgrading to version 5.70 beta 1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 106948†). See VDB-130547, VDB-130549 and VDB-130837 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• File Compression Software

Vendor

• Rarlab

Name

• WinRar

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion