ZDI-CAN-23983: ZDI-24-1234: WinZip Mark-of-the-Web Bypass Vulnerability
This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archive files. When opening an archive that bears the Mark-of-the-Web, WinZip removes the Mark-of-the-Web from the archive file. Following extraction, the extracted files also lack the Mark-of-the-Web. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user.
Other sources
This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-8811.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-23983?
The severity of ZDI-CAN-23983 is rated as moderate due to the requirement for user interaction to exploit the vulnerability.
How do I fix ZDI-CAN-23983?
To fix ZDI-CAN-23983, ensure that you are using the latest version of WinZip with available security patches applied.
Who is affected by ZDI-CAN-23983?
ZDI-CAN-23983 affects installations of WinZip that do not have the latest security updates.
What type of attack does ZDI-CAN-23983 facilitate?
ZDI-CAN-23983 allows remote attackers to bypass the Mark-of-the-Web protection mechanism.
Is user interaction required for exploiting ZDI-CAN-23983?
Yes, user interaction is required as the target must visit a malicious page or open a malicious file to exploit ZDI-CAN-23983.