Vulnerability · Published Mar 24, 2024 · Assigned by GitHub_M
CVE-2024-29188Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
High 7.8
In plain English
A high-severity security flaw in issues from wixtoolset. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | wix | 3.14.1 | GHSA-jx4p-m4wm-vvjg |
| NuGet | wix | 4.0.5 | GHSA-jx4p-m4wm-vvjg |
| NuGet | wixtoolset.util.wixext | 4.0.5 | GHSA-jx4p-m4wm-vvjg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wixtoolset | issues | < 3.14.1>= 4.0.0, < 4.0.5 |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H