A malicious actor launched a faux proof-of-concept (PoC) exploit for a not too long ago disclosed WinRAR vulnerability on GitHub with an goal to contaminate customers who downloaded the code with VenomRAT malware.
“The fake PoC meant to exploit this WinRAR vulnerability was based on a publicly available PoC script that exploited a SQL injection vulnerability in an application called GeoServer, which is tracked as CVE-2023-25157,” Palo Alto Networks Unit 42 researcher Robert Falcone said.
Whereas bogus PoCs have develop into a well-documented gambit for focusing on the research communitythe cybersecurity agency suspected that the menace actors are opportunistically focusing on different crooks who could also be adopting the newest vulnerabilities into their arsenal.
whalersplonk, the GitHub account that hosted the repository, is not accessible. The PoC is alleged to have been dedicated on August 21, 2023, 4 days after the vulnerability was publicly introduced.
CVE-2023-40477 pertains to an improper validation issue within the WinRAR utility that may very well be exploited to realize distant code execution (RCE) on Home windows programs. It was addressed final month by the maintainers in model WinRAR 6.23, alongside one other actively-exploited flaw tracked as CVE-2023-38831.
An evaluation of the repository reveals a Python script and a Streamable video demonstrating how one can use the exploit. The video attracted 121 views in complete.
The Python script, versus operating the PoC, reaches out to a distant server (checkblacklistwords[.]eu) to fetch an executable named Home windows.Gaming.Preview.exe, which is a variant of Venom WAR. It comes with capabilities to listing operating processes and obtain instructions from an actor-controlled server (94.156.253[.]109).
Level-Up SaaS Security: A Comprehensive Guide to ITDR and SSPM
Keep forward with actionable insights on how ITDR identifies and mitigates threats. Be taught concerning the indispensable position of SSPM in guaranteeing your identification stays unbreachable.
A more in-depth examination of the assault infrastructure exhibits that the menace actor created the checkblacklistwords[.]eu area at the very least 10 days previous to the general public disclosure of the flaw, after which swiftly seized upon the criticality of the bug to draw potential victims.
“An unknown threat actor attempted to compromise individuals by releasing a fake PoC after the vulnerability’s public announcement, to exploit an RCE vulnerability in a well-known application,” Falcone stated.
“This PoC is fake and does not exploit the WinRAR vulnerability, suggesting the actor tried to take advantage of a highly sought after RCE in WinRAR to compromise others.”
