Actively exploited · Published Feb 5, 2019 · Assigned by checkpoint
CVE-2018-20250
High 7.8 Exploited Ransomware
In plain English
A high-severity security flaw in WinRAR from Check Point Software Technologies Ltd.. Attackers are actively exploiting it in the wild (listed by CISA on February 15, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 96.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Aug 15, 2022.
Official description
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Check Point Software Technologies Ltd. | WinRAR | All versions prior and including 5.61 |
Weakness: CWE-36 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/blau72/CVE-2018-20250-WinRAR-ACE x_refsource_MISC
- https://research.checkpoint.com/extracting-code-execution-from-winrar/ x_refsource_MISC
- 46552 exploit, x_refsource_EXPLOIT-DB
- 106948 vdb-entry, x_refsource_BID
- https://www.win-rar.com/whatsnew.html x_refsource_MISC
- http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html x_refsource_MISC
- http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace x_refsource_MISC
- 46756 exploit, x_refsource_EXPLOIT-DB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250 government-resource