CVE-2018-20250: high-severity vulnerability in Check Point Software Technologies Ltd. WinRAR
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.
ssvc Actcvss 7.8epss 96%
from disclosure to weapon17 days
Published on NVDFeb 5
1st PoC+17d
metasploitFeb 5
CISA KEV+1106d
Who exploits it — 1
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
APT / StateAPT33🇮🇷 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-08-15
Apply updates per vendor instructions.
In short
WinRAR versions up to 5.61 have a flaw where specially crafted RAR files can extract files outside their intended folder by using absolute paths, potentially placing malicious files anywhere on your system.
Technical detail
A path traversal vulnerability in UNACEV2.dll (ACE format handler) allows an attacker to bypass directory restrictions by embedding absolute paths in the filename field; extraction of a malicious archive with crafted filenames ignores the target folder parameter, enabling arbitrary file write to the filesystem.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Check Point Software Technologies Ltd. · WinRARpublic PoCs found — 45✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/46756exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/46552githubgithub.com/WyAtu/CVE-2018-20250★ 494githubgithub.com/QAX-A-Team/CVE-2018-20250★ 26githubgithub.com/easis/CVE-2018-20250-WinRAR-ACE★ 21githubgithub.com/arkangel-dev/CVE-2018-20250-WINRAR-ACE-GUI★ 7githubgithub.com/Ektoplasma/ezwinrar★ 2githubgithub.com/STP5940/CVE-2018-20250★ 2githubgithub.com/eastmountyxz/CVE-2018-20250-WinRAR★ 1githubgithub.com/technicaldada/hack-winrar★ 1githubgithub.com/joydragon/Detect-CVE-2018-20250★ 0githubgithub.com/likekabin/CVE-2018-20250★ 0githubgithub.com/zeronohacker/CVE-2018-20250★ 0githubgithub.com/tzwlhack/CVE-2018-20250★ 0githubgithub.com/tannlh/CVE-2018-20250★ 0githubgithub.com/LamSonBinh/CVE-2018-20250★ 0githubgithub.com/nmweizi/CVE-2018-20250-poc-winrar★ 0githubgithub.com/H4xl0r/WinRar_ACE_exploit_CVE-2018-20250★ 0githubgithub.com/lxg5763/cve-2018-20250★ 0githubgithub.com/blunden/UNACEV2.DLL-CVE-2018-20250★ 0githubgithub.com/AeolusTF/CVE-2018-20250★ 0vulncheckvulncheck.com/xdb/803834c2bcebunverifiedcve_referencewww.exploit-db.com/exploits/46552/unverifiedcve_referencewww.exploit-db.com/exploits/46756/unverifiedvulncheckvulncheck.com/xdb/87be983eabdbunverifiedvulncheckvulncheck.com/xdb/604c1f5ca052unverifiedvulncheckvulncheck.com/xdb/b1fd1af5a90eunverifiedvulncheckvulncheck.com/xdb/0e24e0f3c860unverifiedvulncheckvulncheck.com/xdb/8781e0635d5aunverifiedvulncheckvulncheck.com/xdb/62e3db5ba632unverifiedvulncheckvulncheck.com/xdb/e67f95be5194unverifiedvulncheckvulncheck.com/xdb/f92a55a02a71unverifiedvulncheckvulncheck.com/xdb/7567f96bd245unverifiedvulncheckvulncheck.com/xdb/0c53977a59e6unverifiedvulncheckvulncheck.com/xdb/1c893692c804unverifiedvulncheckvulncheck.com/xdb/a9f3986f5ca4unverifiedvulncheckvulncheck.com/xdb/769a10397402unverifiedvulncheckvulncheck.com/xdb/89f8948e60fbunverifiedvulncheckvulncheck.com/xdb/4cf24d124675unverifiedvulncheckvulncheck.com/xdb/07d3492b35b0unverifiedvulncheckvulncheck.com/xdb/577747b6d2f6unverifiedcve_referencepacketstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/2f088777b403unverifiedvulncheckvulncheck.com/xdb/265189697577unverifiedvulncheckvulncheck.com/xdb/eae7eb1d7404unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Check Point Software Technologies Ltd. WinRAR
In the same product, most dangerous first.
References
http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.htmlhttps://github.com/blau72/CVE-2018-20250-WinRAR-ACEhttps://research.checkpoint.com/extracting-code-execution-from-winrar/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250https://www.exploit-db.com/exploits/46552/https://www.exploit-db.com/exploits/46756/https://www.win-rar.com/whatsnew.htmlhttp://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_acehttp://www.securityfocus.com/bid/106948