Overview
During observation of WinZip 24 network communications, I've noticed that it sends update check requests cleartext (HTTP). Same cleartext communication is utilized when Trial pop-ups are displayed and could be used to deliver malware to users’ computers.
First Finding
You can see a screenshot of a Wireshark capture of the update request in Figure 1 below.
Figure 1: Packet capture of the WinZip 24 update request
Since HTTP is unencrypted cleartext, it can be grabbed, manipulated, or highjacked by anyone with the ability to see that traffic. This means anyone on the same network as user running a vulnerable version of WinZip can use techniques like DNS poisoning to trick the application to fetch “update” files from malicious web server instead of legitimate WinZip update host. As a result, unsuspecting user can launch arbitrary code as if it is a valid update.
In addition, the application sends out potentially sensitive information like the registered username, registration code and some other information in query string as a part of the update request. Since this is over an unencrypted channel this information is fully visible to the attacker.
Second Finding
A second issue I discovered is that WinZip 24 opens pop-up windows time to time when running in Trial mode. Since the content of these popups is HTML with JavaScript that is also retrieved via HTTP, it makes manipulation of that content easy for a network adjacent attacker. In the end, malicious actors can exploit this issue to execute arbitrary code as in previous scenario.
Example pop-up that fetches content over HTTP:
Mitigations
These findings have been through our responsible disclosure program and WinZip users can mitigate these issues by upgrading (not for free) to the latest version of WinZip (version 25 at the time of this writing). That version properly uses HTTPS and is no longer vulnerable to these sorts of attacks. Users that can’t upgrade should opt out of update checks and manually look for and verify updates.
References
Trustwave Advisory TWSL2020-009
