Actu
CVE-2020-28003: Insecure Communication in WinZip 24 Could Lead to Malware
December 2020 by Trustwave
During observation of WinZip 24 network communications, I’ve noticed that it sends update check requests cleartext (HTTP). Same cleartext communication is utilized when Trial pop-ups are displayed and could be used to deliver malware to users’ computers.
Martin Rakhmanov, Security Research Manager, Trustwave SpiderLabs
First Finding
You can see a screenshot of a Wireshark capture of the update request in Figure 1 below.
Figure 1: Packet capture of the WinZip 24 update request
Since HTTP is unencrypted cleartext, it can be grabbed, manipulated, or highjacked by anyone with the ability to see that traffic. This means anyone on the same network as user running a vulnerable version of WinZip can use techniques like DNS poisoning to trick the application to fetch “update” files from malicious web server instead of legitimate WinZip update host. As a result, unsuspecting user can launch arbitrary code as if it is a valid update.
In addition, the application sends out potentially sensitive information like the registered username, registration code and some other information in query string as a part of the update request. Since this is over an unencrypted channel this information is fully visible to the attacker.
Second Finding (CVE-2020-28003)
A second issue I discovered is that WinZip 24 opens pop-up windows time to time when running in Trial mode. Since the content of these popups is HTML with JavaScript that is also retrieved via HTTP, it makes manipulation of that content easy for a network adjacent attacker. The interesting part is that there are some APIs provided by WinZip to the JavaScript that are quite powerful. In the end, malicious actors can exploit this issue to execute arbitrary code as in previous scenario. You can see an example of a pop-up that fetches content over HTTP in Figure 2.
Figure 2: WinZip 24 pop-up
Mitigations
These findings have been through our responsible disclosure program and WinZip users can mitigate these issues by upgrading (not for free) to the latest version of WinZip (version 25 at the time of this writing). That version properly uses HTTPS and is no longer vulnerable to these sorts of attacks. Users that can’t upgrade should opt out of update checks as shown in Figure 3 and manually look for and verify updates
Figure 3: WinZip 24 Settings to opt-out of automatic updates
References
TWSL2020-009
