RARLAB · WinRAR
WinRAR (by RARLAB) contains an absolute path traversal flaw in its handling of the filename field in ACE-format archives, implemented in the UNACEV2.dll component, affecting versions up to and including 5.61. When a specially crafted filename is processed, WinRAR ignores the chosen extraction folder and treats the filename as an absolute path, so an attacker who can get a user to open a malicious ACE archive (local access, user interaction required, no authentication) can cause files to be written to arbitrary locations.
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
First seen exploited 23 days after disclosure. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Attacker-controlled absolute path writes files outside intended folder
the destination (extraction) folder is ignored, thus treating the filename as an absolute path
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2018-20250 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
HOLMIUM has been observed using various vectors for initial access, including spear-phishing email, sometimes carrying archive attachments that exploit the CVE-2018-20250 vulnerability in WinRAR, and password-spraying.
In a recent wave of attacks during February 2019, Elfin attempted to exploit a known vulnerability (CVE-2018-20250) in WinRAR, the widely used file archiving and compression utility capable of creating self-extracting archive files.
2 passages name itOriginal (opens in a new tab) ↗
‘SysAid-Documentation’ that contained an exploit of the vulnerability assigned CVE -2018-20250,…
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.