CVE-2018-20250

CVE-2018-20250 is a high-severity (CVSS 7.8) vulnerability in RARLAB WinRAR. CISA added it to the Known Exploited Vulnerabilities catalog on February 15, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by August 15, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. RARLAB has 5 vulnerabilities in the KEV catalog, 4 of them linked to ransomware.

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
• http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
• http://www.securityfocus.com/bid/106948
• https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
• https://research.checkpoint.com/extracting-code-execution-from-winrar/
• https://www.exploit-db.com/exploits/46552/
• https://www.exploit-db.com/exploits/46756/
• https://www.win-rar.com/whatsnew.html