In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
| Link | Tags |
|---|---|
| https://github.com/blau72/CVE-2018-20250-WinRAR-ACE | third party advisory exploit |
| https://research.checkpoint.com/extracting-code-execution-from-winrar/ | press/media coverage exploit third party advisory |
| https://www.exploit-db.com/exploits/46552/ | exploit vdb entry third party advisory |
| http://www.securityfocus.com/bid/106948 | vdb entry third party advisory broken link |
| https://www.win-rar.com/whatsnew.html | release notes |
| http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html | exploit vdb entry third party advisory |
| http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace | third party advisory |
| https://www.exploit-db.com/exploits/46756/ | exploit vdb entry third party advisory |