RARLAB WinRAR before 6

CVE-2023-38831 is a WinRAR code-execution bug in Windows builds before 6.23. A crafted ZIP can contain a benign-looking file and a same-named folder carrying script or executable content; when the user tries to open the harmless-looking file from inside WinRAR, the hidden payload can get launched instead. In practice, attackers used it to disguise .cmd, .bat, and other launcher content as images or documents.

The vendor's 7.8 HIGH baseline is directionally right, but it undersells the operational reality that this bug was *actually exploited in the wild*, landed in CISA KEV, and quickly got public exploit generators. At the same time, it is not a network-reachable server bug: it needs archive delivery plus a user click on a Windows endpoint, which keeps it out of CRITICAL despite the ugly impact once it lands.

Why this verdict

• Upward pressure: KEV + real abuse. This is not hypothetical; it was exploited as a 0-day and later appeared in CISA KEV, which materially raises operational priority over a generic AV:L/UI:R desktop bug.
• Upward pressure: public exploit chain. Public GitHub generators and a Metasploit module lower attacker cost and make copycat campaigns cheap.
• Downward pressure: attacker still needs delivery and a click. This requires phishing, download lures, or another content channel plus user interaction, so it is not equivalent to an unauthenticated network service RCE.
• Downward pressure: reachability is narrower than CVSS panic suggests. It only matters on Windows endpoints running WinRAR <6.23; enterprises standardized on 7-Zip, native Explorer, or fully patched WinRAR have zero exposure.
• Downward pressure: blast radius starts per-host. Initial execution is typically in the current user's context, and EDR or application control often has a second chance to stop payload execution.

Why not higher?

It is not a remotely reachable infrastructure bug and it does not let an attacker compromise hosts without a delivery channel and user action. In real deployments, that means this vulnerability usually rides on top of phishing or another initial-access stage rather than replacing it.

Why not lower?

Dropping this to MEDIUM would ignore the part that matters most to defenders: *attackers actually used it*, KEV tracked it, and public exploit tooling made it easy to reproduce. A UI-required desktop bug can still be top-tier patch work when it becomes a reliable malware delivery primitive on large Windows fleets.

1. Block WinRAR child-process execution — Use EDR or application control to alert or deny WinRAR.exe spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, or rundll32.exe. Because this verdict is HIGH, deploy within 30 days; however, because there is KEV-listed active exploitation, apply this immediately, within hours where patching cannot happen the same day.
2. Hunt and remove WinRAR <6.23 — Use endpoint inventory, uninstall registry keys, and file-version checks to find all vulnerable WinRAR installs and either upgrade or remove them. For a HIGH finding the baseline deadline is within 30 days, but active exploitation overrides that to immediately, within hours for internet-exposed users, high-risk departments, and shared admin workstations.
3. Quarantine suspicious ZIP lures — Tune secure email, web, and collaboration gateways to detonate or quarantine ZIP archives from untrusted senders, especially those containing image/document lures with script content. This is a same-day mitigation move when immediate upgrade coverage is incomplete.
4. Restrict script hosts and LOLBins — Apply WDAC, AppLocker, ASR, or equivalent controls to cut off the common second stage even if the archive opens. Enforce on high-risk user populations first and complete rollout within 30 days, or within hours if those groups are actively targeted.

Run this on the target Windows endpoint or through your EDR/management tool in a remote PowerShell session. Example: powershell.exe -ExecutionPolicy Bypass -File .\check-winrar-cve-2023-38831.ps1; no admin rights are strictly required, but local admin helps if you want consistent access to install paths and uninstall registry data.

# check-winrar-cve-2023-38831.ps1

# Detect WinRAR versions vulnerable to CVE-2023-38831

# Outputs one of: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'
$patchedVersion = [version]'6.23'

function Get-WinRARVersionFromExe {
    param([string]$Path)
    if (Test-Path $Path) {
        try {
            $item = Get-Item $Path
            if ($item.VersionInfo -and $item.VersionInfo.ProductVersion) {
                return [version]($item.VersionInfo.ProductVersion -replace '[^0-9\.]','')
            }
        } catch {}
    }
    return $null
}

function Get-WinRARVersionFromRegistry {
    $keys = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    foreach ($k in $keys) {
        try {
            $apps = Get-ItemProperty $k
            foreach ($app in $apps) {
                if ($app.DisplayName -match '^WinRAR(\s|$)') {
                    $dv = $app.DisplayVersion
                    if ($dv) {
                        try {
                            return [version]($dv -replace '[^0-9\.]','')
                        } catch {}
                    }
                }
            }
        } catch {}
    }
    return $null
}

$paths = @(
    "$env:ProgramFiles\WinRAR\WinRAR.exe",
    "$env:ProgramFiles(x86)\WinRAR\WinRAR.exe",
    "$env:LocalAppData\Programs\WinRAR\WinRAR.exe"
)

$detected = @()
foreach ($p in $paths) {
    $v = Get-WinRARVersionFromExe -Path $p
    if ($v) { $detected += $v }
}

$regv = Get-WinRARVersionFromRegistry
if ($regv) { $detected += $regv }

if (-not $detected -or $detected.Count -eq 0) {
    Write-Output 'UNKNOWN: WinRAR not found via common paths or uninstall registry keys.'
    Write-Output 'UNKNOWN'
    exit 2
}

$best = $detected | Sort-Object -Descending | Select-Object -First 1

if ($best -lt $patchedVersion) {
    Write-Output ("Detected WinRAR version: {0}" -f $best)
    Write-Output 'VULNERABLE'
    exit 1
} else {
    Write-Output ("Detected WinRAR version: {0}" -f $best)
    Write-Output 'PATCHED'
    exit 0
}

Sources

1. RARLAB / win-rar GmbH WinRAR 6.23 release note
2. NVD CVE-2023-38831
3. Group-IB original zero-day writeup
4. Google TAG on government-backed exploitation
5. McAfee technical analysis
6. Rapid7 Metasploit module
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS project and API