CVE-2023-38831 PoC — WinRAR 安全漏洞

Source

https://github.com/imbyter/imbyter-WinRAR_CVE-2023-38831

Associated Vulnerability

Title:WinRAR 安全漏洞 (CVE-2023-38831)
Description:RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

Description

WinRAR漏洞测试复现。详参：https://flowus.cn/share/a3b35db0-ab5e-4abc-b8d3-5ff284e82e7b

Readme

## 💥 WinRAR 漏洞说明（CVE-2023-38831）

> 在WinRAR版本6.23之前存在可欺骗文件扩展名漏洞，攻击者可以利用这个漏洞，构造特制压缩包中看似无害的文件，例如 JPG (.jpg) 图像文件、文本文件 (.txt) ，或 PDF文档 (.pdf)等文件，然后诱导用户在不解压的情况下直接打开这些文件，即可成功在受害者机器上执行任意代码。

- 漏洞编号：CVE-2023-38831
- 漏洞类型：逻辑漏洞
- 软件名称：RARLAB WinRAR
- 模块名称：WinRAR.exe
- 历史漏洞：从 [https://vuldb.com](https://vuldb.com/) 的搜索结果来看，历史漏洞并不是很多，能稳定利用的更少。
- 影响版本：版本号 < 6.23（实测5.x版本不受漏洞影响）

## 🧨 测试POC压缩包

文件：[test.zip](/test.zip)

> 这是一个已经做好的存在CVE-2023-38831漏洞的压缩包，用`WinRAR<6.23`的版本直接打开压缩包中`2.jpg`，会运行压缩包中bat脚本。bat脚本内容如下：

```shell
echo off
mshta vbscript:msgbox("你电脑已经被我控制！！！",64,"被黑了")(window.close)
shutdown -s -t 60
```

> 测试成功后提示关机，在cmd中输入`shutdown -a`即可取消关机任务。

![图片](/screenshot/demo.gif)

## 🧑‍💻 Python代码

文件：make-poc.py

> 用于将输入的文件自动转换为POC的压缩包

## 🥝 详细说明

参见：[https://flowus.cn/share/a3b35db0-ab5e-4abc-b8d3-5ff284e82e7b](https://flowus.cn/share/a3b35db0-ab5e-4abc-b8d3-5ff284e82e7b)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!