WinRAR CVE-2023-38831 (opening a harmless-looking file in a crafted ZIP runs code, exploited since April 2023 by criminal and state-backed groups, CISA KEV): which version fixes it and how do I find old WinRAR installs?

What it is: CVE-2023-38831 is a flaw in how RARLAB WinRAR before 6.23 opened files from inside an archive. A ZIP could contain an ordinary-looking file (for example a .jpg or .pdf) and a folder with the same name; when the user double-clicked the harmless file, WinRAR could run content from the folder instead. It was used as a zero-day from April 2023 against traders, and after the fix by several state-backed groups in phishing campaigns, as Google's Threat Analysis Group reported. CISA added it to the Known Exploited Vulnerabilities catalog on 2023-08-24. WinRAR has no automatic updater, so old copies stay around for years. Am I affected: - WinRAR for Windows older than 6.23 (6.23 was released in August 2023). Check Help > About WinRAR, or the version of WinRAR.exe in Program Files. Inventory endpoints with your software management tool; also look for portable copies. - Other tools that embed old WinRAR/UnRAR components should be checked against their own vendor's advice. Fix: 1. Install the latest WinRAR from the official RARLAB/win-rar.com site (6.23 or later; later versions also fix further issues), and push it through your software deployment tool. Uninstall WinRAR where it isn't needed. 2. Since WinRAR doesn't update itself, add it to your patch-management or vulnerability scanning so old versions get flagged. 3. Treat archives from email and chat as risky: mail gateways can block or sandbox archives, and users should report unexpected archives. 4. If someone opened a suspicious archive with an old version, check that machine for unexpected processes, scheduled tasks or startup entries and outbound connections, run your endpoint security scan, and reset credentials used on it if anything looks wrong. Verify: every endpoint reports WinRAR 6.23 or newer (or none), and your scanner no longer flags CVE-2023-38831. Sources: https://www.rarlab.com/rarnew.htm https://nvd.nist.gov/vuln/detail/CVE-2023-38831 https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38831