ZDI-CAN-23156: ZDI-24-357: RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability
This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must perform a specific action on a malicious page. The specific flaw exists within the archive extraction functionality. A crafted archive entry can cause the creation of an arbitrary file without the Mark-Of-The-Web. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current user.
Other sources
This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must perform a specific action on a malicious page. The ZDI has assigned a CVSS rating of 4.3. The following CVEs are assigned: CVE-2024-30370.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-23156?
The severity of ZDI-CAN-23156 is classified as high due to its potential to allow remote attackers to bypass security protections.
How do I fix ZDI-CAN-23156?
To fix ZDI-CAN-23156, update your RARLAB WinRAR to the latest version as released by the vendor.
What systems are affected by ZDI-CAN-23156?
ZDI-CAN-23156 affects installations of RARLAB WinRAR, specifically those versions that have not been updated with the latest patches.
What type of attack does ZDI-CAN-23156 facilitate?
ZDI-CAN-23156 facilitates a remote attack that enables bypassing the Mark-Of-The-Web protection mechanism.
Is user interaction required to exploit ZDI-CAN-23156?
Yes, user interaction is required to exploit ZDI-CAN-23156 as the target must perform a specific action on a malicious page.