CVE-2023-38831 Explained: WinRAR Remote Code Execution via Crafted Archive

ZIP archives can contain both files and folders at the same path prefix. CVE-2023-38831 exploits a flaw in how WinRAR renders and handles the contents of a ZIP archive when a user double-clicks a displayed entry.

The attacker creates a ZIP archive with two items sharing the same base name: 1. An innocent-looking file: `trading_strategy.pdf` 2. A folder named: `trading_strategy.pdf ` (with a trailing space) containing a script: `trading_strategy.pdf .bat` or `.cmd`

When the archive is opened in vulnerable WinRAR, the interface displays only the apparent PDF. When the user double-clicks it, WinRAR's file handling logic navigates into the folder bearing the same name and executes the script found inside — not the displayed PDF. The user sees nothing unusual. A command prompt may flash briefly, but the script has already run.

The key flaw is that WinRAR resolves the file path via the folder with the matching name rather than executing the displayed file, due to inconsistency between how the archive listing is rendered and how double-click is handled. The result is that user intent (open a PDF) is silently replaced by attacker intent (execute a script).

Group-IB identified CVE-2023-38831 exploitation beginning in April 2023 — making it a four-month zero-day before the patch. The initial campaigns targeted cryptocurrency traders and financial professionals, delivering WinRAR archives that appeared to contain trading strategies, investment analyses, and market data.

Google TAG subsequently confirmed exploitation by multiple state-sponsored actors. APT28 (Fancy Bear, GRU Unit 26165) was confirmed using CVE-2023-38831 in campaigns targeting European financial institutions and energy sector entities. APT40 (North Korean group also tracked as TA423) used the vulnerability in campaigns targeting government officials and think tank researchers in the Asia-Pacific region.

The attack pattern — crafted archive delivered by email, displaying an innocent filename — is effective because it bypasses most email gateway detections (the archive is genuinely a ZIP file containing a real PDF), exploits user trust in a familiar workflow (double-click to open a file), and requires no macros, no Office document interaction, and no UAC prompt for initial execution.

The fix is simple: upgrade WinRAR. Detection focuses on identifying unpatched installations and reviewing endpoint logs for suspicious archive-related process activity.

CVE-2023-38831 is a demonstration that high-impact vulnerabilities do not need to be technically sophisticated. The exploit is a file structure trick — a ZIP that shows one thing and does another. What makes it effective is not the technical cleverness but the social engineering: users trust the files they see in their archive viewer, particularly when the filename matches their expectations.

State-sponsored actors chose CVE-2023-38831 for targeted campaigns precisely because it bypasses technical defences and exploits human behaviour. It cleared email gateways, it looked legitimate to the victim, and it required no special permissions to execute. For any organisation whose users handle email attachments containing ZIP files — which is effectively every organisation — ensuring WinRAR is patched to 6.23 or later is a straightforward and necessary control.