# CVE-2023-38831: RARLAB WinRAR Code Execution Vulnerability

WinRAR temp-extracts files from a directory whose name prefix-matches the selected file, then ShellExecute's default-extension search runs an attacker .cmd instead of the benign file.

- Payout: Real-world hack
- Severity: high
- Program: RARLAB WinRAR
- Credited: Vlad Stolyarov, Google Threat Analysis Group
- Disclosed: 2023-07-20
- CVE: CVE-2023-38831
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2023/CVE-2023-38831.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2023-38831
- Tags: domain:desktop impact:rce kind:incident platform:project-zero sev:high tech:windows technique:chained technique:source-review vuln:path-traversal vuln:rce

**Target:** WinRAR archive preview / ShellExecuteExW on Windows
**Root cause:** ShouldExtractArchiveEntry uses startswith(selected_filename) so a directory sharing the selected file's name prefix is also extracted to the temp root; WinRAR then passes a non-normalized trailing-space path to ShellExecuteExW, whose PathFindExtension fails and ApplyDefaultExts executes the first .cmd/.exe/.bat in the directory.
**Steps:**
1. Craft archive with benign entry `poc.png ` (trailing space) and directory `poc.png /` containing `poc.png .cmd` payload.
2. User double-clicks `poc.png ` in WinRAR UI.
3. ShouldExtractArchiveEntry matches both the file and the directory contents (startswith), extracting both to `%TEMP%\{random}\`.
4. WinRAR normalizes trailing spaces when writing files but calls `ShellExecuteExW("%TEMP%\{random}\poc.png ")` with the unnormalized path.
5. shell32!PathFindExtension rejects the space-containing extension; ApplyDefaultExts scans the dir and executes `poc.png .cmd`.
6. Payload runs arbitrary code.
**How found:** Likely accidental discovery during WinRAR code audit; the write-up notes the bug requires user double-click and was probably not found by intentional fuzzing.
**Exploitation:** Attacker distributes a crafted RAR/ZIP; victim double-clicks an apparently benign file (e.g. PNG) in WinRAR preview, causing the bundled .cmd to execute with the victim's privileges. Used as zero-day by cybercriminals targeting traders.
**Insight:** When auditing archive/container tools, check whether temp-extraction matching uses prefix (startswith) rather than exact comparison, and whether the path handed to the OS launcher is normalized the same way as the path used for writing files — a mismatch lets sibling directory contents land in the temp root and be executed by ShellExecute's default-extension search.