ZDI-24-357: RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability
This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must perform a specific action on a malicious page. The specific flaw exists within the archive extraction functionality. A crafted archive entry can cause the creation of an arbitrary file without the Mark-Of-The-Web. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current user.
Other sources
This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must perform a specific action on a malicious page. The ZDI has assigned a CVSS rating of 4.3. The following CVEs are assigned: CVE-2024-30370.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-357?
The severity of ZDI-24-357 is considered medium due to the potential for remote attackers to bypass security mechanisms.
How do I fix ZDI-24-357?
To fix ZDI-24-357, users should update their RARLAB WinRAR to the latest version available from the official site.
What are the potential impacts of ZDI-24-357?
The potential impacts of ZDI-24-357 include unauthorized access to files and data due to bypassed security protections.
Who is affected by ZDI-24-357?
ZDI-24-357 affects installations of RARLAB WinRAR that have not been updated to address this vulnerability.
What steps should users take to protect against ZDI-24-357?
Users should exercise caution when interacting with unfamiliar web pages and ensure their WinRAR software is updated.