{"id":69,"date":"2021-05-03T01:27:00","date_gmt":"2021-05-02T18:27:00","guid":{"rendered":"https:\/\/n45ht.or.id\/blog\/?p=69"},"modified":"2025-10-14T20:41:01","modified_gmt":"2025-10-14T13:41:01","slug":"winrar-xss","status":"publish","type":"post","link":"https:\/\/n45ht.or.id\/blog\/winrar-xss\/","title":{"rendered":"WinRAR XSS"},"content":{"rendered":"\n<p>A few days ago, I discovered a <strong>Cross-site Scripting (XSS)<\/strong> vulnerability in <strong>WinRAR<\/strong>. In this article, I\u2019ll walk you through the steps I took to find this vulnerability and how it works.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What is WinRAR?<\/h3>\n\n\n\n<p>WinRAR is a trialware file archiver utility for <strong>Windows<\/strong>, developed by <strong>Eugene Roshal<\/strong> of <strong>win.rar GmbH<\/strong>. It allows users to create and view archives in <strong>RAR<\/strong> or <strong>ZIP<\/strong> file formats and unpack a variety of other archive formats as well.<\/p>\n\n\n\n<p>For more detailed information, you can check the source on <a href=\"https:\/\/en.wikipedia.org\/wiki\/WinRAR\">Wikipedia<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Observing the WinRAR Behavior<\/h3>\n\n\n\n<p>When I first opened <strong>WinRAR<\/strong>, I noticed that there was a window that seemed to make an HTTP request to an external web page. This caught my attention, as it could potentially be a vector for injecting malicious code.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"660\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-1-1024x660.png\" alt=\"\" class=\"wp-image-71\" style=\"width:524px;height:auto\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-1-1024x660.png 1024w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-1-300x193.png 300w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-1-768x495.png 768w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-1.png 1059w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Capturing the HTTP Request<\/h3>\n\n\n\n<p>Immediately, I opened <strong>BurpSuite<\/strong>, a popular tool for intercepting and modifying HTTP requests. I used it to capture the requests made by <strong>WinRAR<\/strong> when this window was opened.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"667\" height=\"272\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-2.png\" alt=\"\" class=\"wp-image-72\" style=\"width:529px;height:auto\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-2.png 667w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-2-300x122.png 300w\" sizes=\"auto, (max-width: 667px) 100vw, 667px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Investigating the Request URL<\/h3>\n\n\n\n<p>The HTTP request was being sent to the following URL:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;notifier.win-rar.com\/?language=English&amp;source=wrr&amp;landingpage=first&amp;version=600&amp;architecture=64<\/code><\/pre>\n\n\n\n<p>This URL appeared to be related to WinRAR\u2019s notification system, likely sending version and language information to the server.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Testing for XSS Vulnerability<\/h3>\n\n\n\n<p>Curious if the URL was vulnerable to XSS, I decided to run a test using my private <strong>XSS Scanner<\/strong>. This tool automatically scans URLs for potential Cross-site Scripting vulnerabilities by inserting common payloads into URL parameters.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"358\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-3-1024x358.png\" alt=\"\" class=\"wp-image-73\" style=\"width:582px;height:auto\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-3-1024x358.png 1024w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-3-300x105.png 300w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-3-768x269.png 768w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-3.png 1120w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Exploiting the XSS Vulnerability via BurpSuite<\/h3>\n\n\n\n<p>Next, I manually injected several <strong>XSS payloads<\/strong> into the URL using <strong>BurpSuite<\/strong> to see if the server would reflect the input without proper sanitization.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"551\" height=\"231\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-4.png\" alt=\"\" class=\"wp-image-74\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-4.png 551w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-4-300x126.png 300w\" sizes=\"auto, (max-width: 551px) 100vw, 551px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: XSS Triggered in WinRAR Window<\/h3>\n\n\n\n<p>To my surprise, the <strong>XSS vulnerability<\/strong> successfully triggered when the payloads were executed. The <strong>WinRAR window<\/strong> displayed the injected JavaScript, confirming that <strong>WinRAR<\/strong> was vulnerable to <strong>Reflected XSS<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"653\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-5-1024x653.png\" alt=\"\" class=\"wp-image-75\" style=\"width:562px;height:auto\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-5-1024x653.png 1024w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-5-300x191.png 300w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-5-768x490.png 768w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-winrar1-5.png 1027w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Demonstrating the Vulnerability (Video PoC)<\/h3>\n\n\n\n<p>To provide a clearer demonstration of how the XSS vulnerability works in <strong>WinRAR<\/strong>, I created a video proof of concept (PoC). In the video, you can see the XSS payload being triggered and executed within the WinRAR window.<\/p>\n\n\n\n<figure class=\"wp-block-video aligncenter\"><video controls src=\"https:\/\/n45ht.or.id\/images\/post\/writeup-winrar1-vid.mp4\"><\/video><\/figure>\n\n\n\n<p>By following these steps, I was able to identify a <strong>Reflected XSS vulnerability<\/strong> in <strong>WinRAR<\/strong>, which could potentially allow an attacker to execute malicious JavaScript in the context of the application. This type of vulnerability could be exploited for a variety of malicious actions, including stealing user data or compromising the system.<\/p>\n\n\n\n<p>I reported the vulnerability responsibly to the WinRAR team, and I hope they address it promptly to improve the security of the software.<\/p>\n\n\n\n<p>#HappyHacking<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A few days ago, I discovered a Cross-site Scripting (XSS) vulnerability in WinRAR. In this article, I\u2019ll walk you through the steps I took to find this vulnerability and how it works. What is WinRAR? WinRAR is a trialware file archiver utility for Windows, developed by Eugene Roshal of win.rar GmbH. It allows users to [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":305,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[23,9,8],"class_list":["post-69","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-research","tag-bug-bounty","tag-cross-site-scripting","tag-xss"],"_links":{"self":[{"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/posts\/69","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/comments?post=69"}],"version-history":[{"count":1,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/posts\/69\/revisions"}],"predecessor-version":[{"id":76,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/posts\/69\/revisions\/76"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/media\/305"}],"wp:attachment":[{"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/media?parent=69"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/categories?post=69"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/tags?post=69"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}