High severity · published Feb 5, 2019
CVE-2018-20250
WinRAR Absolute Path Traversal Vulnerability
RansomwareIn wildKEV
7.8
CVSS
96%
EPSS
Yes
On KEV
Description
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)96.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Feb 15, 2022
Federal remediation dueAug 15, 2022
Ransomware campaign useKnown
Affected products
Which versions
WI
WinRAR · Check Point Software Technologies Ltd.
All versions prior and including 5.61 · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-20250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-20250
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
x_refsource_MISC
https://research.checkpoint.com/extracting-code-execution-from-winrar/
exploit
https://www.exploit-db.com/exploits/46552/
vdb-entry
http://www.securityfocus.com/bid/106948
x_refsource_MISC
https://www.win-rar.com/whatsnew.html
x_refsource_MISC
http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
More from WinRAR
7.8
CVE-2018-20253
In WinRAR versions prior to and including 5.60, There is an out-of-bounds write vulnerability during parsing of a crafted LHA / LZH archive formats
7.8
CVE-2018-20252
In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive formats
5.5
CVE-2018-20251
In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format