The importance of email security cannot be understated. Proof of this can be seen in some recent research conducted by the Trustwave SpiderLabs team around our email security product MailMarshal.
The team recently ran an experiment on known Zero Day CVE-2023-38831 found in RARLabs WinRAR that is currently being exploited in the wild in WinRAR versions 6.23 and earlier. WinRAR is a compression, archiving, and archive managing software tool. It allows users to compress or archive multiple electronic files into single and significantly smaller size folders.
The vulnerability was published in the NIST National Vulnerability Database in August and RARLabs has issued an updated version of WinRAR, but organizations using older versions remain susceptible.
“The vulnerability is actively being used by attackers. It exploits a flaw in WinRAR. Email messages have a specially crafted ZIP archive attached,” said Phil Hay, Sr. Research Manager, Email Security and Malware Analysis, SpiderLabs Research.
The issue lies in the archives, where threat actors can surreptitiously insert files and folders with matching names. When a user attempts to access one of the benign files, the ZIP archive may contain a similarly named folder concealing executable content, which is executed, Hay said.
Hay noted that multiple threat groups have been using this exploit. Most recently the APT29 Group linked to Russia has been using this exploit to target several national embassies with malicious attachments.
The Trustwave team obtained samples of a malicious email attachment designed to exploit this vulnerability and ran it through. Thanks to MailMarshal, the samples were ‘DeadLettered’ (i.e., not further processed) because of errors encountered during extraction of the archive relating to the suspicious file/folder names.
This is another example of the wider power of MailMarshal’s Engine that helps Trustwave detect an extensive range of threats, known and unknown.