CVE-2024-29187: WiX based installers are vulnerable to binary hijack when run as SYSTEM
First published: Sun Mar 24 2024(Updated: )
### Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. ### Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. icacls c:\windows\temp **BUILTIN\Users:(CI)(S,WD,AD,X)** BUILTIN\Administrators:(F) BUILTIN\Administrators:(OI)(CI)(IO)(F) NT AUTHORITY\SYSTEM:(F) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) CREATOR OWNER:(OI)(CI)(IO)(F) Built in users(non-administrators) have special permissions to this folder and can create files and write to this directory. While they do not have explicit read permissions, there is a way they can monitor the changes to this directory using ReadDirectoryChangesW API and thus figure out randomized folder names created inside this directory as wel ### PoC PoC works against the against visual studio enterprise with update 3 [installer ](https://myvs.download.prss.microsoft.com/dbazure/en_visual_studio_enterprise_2015_with_update_3_x86_x64_dvd_8923288.iso?t=8132cd54-4b83-4478-8b73-fd9eb93437bf&P1=1709239640&P2=601&P3=2&P4=iorgKPv%2bG8n2NANTPUVoB92rr8t3W4XM594%2f9BtQQJrYrr8SwxGDxV%2fj%2f2F6Ulto0bXrIaFoZUr4yV37YAsOZVpM29IMtQEO0673AbDVuTe93qDb6wb7xdlpZSse0LZURUwwIFw5cwHQS2ZtvkunXE0osgXtEBT2IzVbPwVH39%2fum854xb4e2Dp61wgNrMZcOLLluBbeA3KX1sP3mm7WAWXBvlFiQWEnTfR5XH5mlLyPy2qfqCXWCjl84jNX7uY%2bpLR1IbfeD2JlcIQNeW2QrvmmqRrRbGvvaCA97IaSjM16XcDqVjvAEGW3sWXUc7y%2fEf68WZIyT7iilaEDUvaqqA%3d%3d&su=1) #### Reproduction steps As a standard user, run the poc. Mount the iso and run visual studio installer as local system account. The PoC should hijack the the binaries dropped by vs installer and a child process "notepad.exe" will be running. ### Impact This is an Elevation of Privilege Vulnerability where a low privileged user can hijack binaries in an unprotected path C:\Windows\Temp to elevate to the SYSTEM user privileges.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| nuget/WixToolset.Sdk | <4.0.5 | 4.0.5 |
| nuget/wix | >=4.0.0<4.0.5 | 4.0.5 |
| nuget/wix | <3.14.1 | 3.14.1 |
| Microsoft Visual Studio 2019 | =16.11 | |
| Microsoft Visual Studio 2017 | =15.9 | |
| Visual Studio Community 2022 | =17.10 | |
| Visual Studio Community 2022 | =17.6 | |
| Visual Studio Community 2022 | =17.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r
- https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7
- https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9
- https://nvd.nist.gov/vuln/detail/CVE-2024-29187
- https://github.com/advisories/GHSA-rf39-3f98-xr7r (Advisory)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29187 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-29187?
CVE-2024-29187 is considered a high severity vulnerability due to its exploitation potential in unprotected directories.
How do I fix CVE-2024-29187?
To remediate CVE-2024-29187, upgrade to a secure version of the affected software as specified in the remedy section.
Which versions of Visual Studio are affected by CVE-2024-29187?
CVE-2024-29187 affects Visual Studio versions 17.6, 17.8, 17.10, as well as 2019 version 16.11 and 2017 version 15.9.
Is WixToolset affected by CVE-2024-29187?
Yes, WixToolset versions prior to 4.0.5, as well as 3.14.1, are affected by CVE-2024-29187.
What is the impact of CVE-2024-29187?
The impact of CVE-2024-29187 includes potential unauthorized execution of arbitrary binaries by low privilege users.
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/type
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-rf39-3f98-xr7r
- alias/CVE-2024-29187
- agent/software-canonical-lookup
- collector/github-advisory
- agent/epss
- collector/epss-latest
- source/FIRST
- agent/references
- agent/severity
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/msrc
- source/Microsoft
- collector/msrc-cve
- agent/trending
- agent/source
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- package-manager/nuget
- vendor/microsoft
- canonical/microsoft visual studio 2019
- version/microsoft visual studio 2019/16.11
- canonical/microsoft visual studio 2017
- version/microsoft visual studio 2017/15.9
- canonical/visual studio community 2022
- version/visual studio community 2022/17.10
- version/visual studio community 2022/17.6
- version/visual studio community 2022/17.4
- version/visual studio community 2022/17.8