GHSA-259p-rvjx-ffwg

First published: Thu Feb 08 2024(Updated: )

# Summary .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. # Details If the bundle is not run as admin, the user's TEMP folder is used and not the system TEMP folder. A utility is able to monitor the user's TEMP folder for changes and drop its own DLL into the .be/.Local folder immediately when the .be folder is created. When the burn engine elevates, the malicious DLL receives elevated privileges. # PoC As a standard, non-admin user: 1. Monitor the user's TEMP folder for changes using ReadDirectoryChangesW 1. On FILE_ACTION_ADDED, check if the folder name is .be 1. Create a folder in .be named after the bundle + .Local (e.g. MyInstaller.exe.Local) 1. Put the malicious COMCTL32.DLL in the .Local folder following the naming used for the real DLL (e.g. MyInstaller.exe.Local/x86_microsoft.windows.common-controls_.../COMCTL32.dll) 1. Do hacker things when the engine escalates and the malicious DLL is loaded Proper naming for the path can be obtained by using GetModuleHandle("comctl32.dll") and GetModuleFileName. # Impact DLL redirection utilizing .exe.Local Windows capability. This impacts any installer built with the WiX installer framework.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/github-advisory-latest
• source/GitHub
• alias/GHSA-259p-rvjx-ffwg
• agent/software-canonical-lookup
• agent/weakness
• agent/references
• agent/softwarecombine
• agent/last-modified-date
• agent/type
• agent/first-publish-date
• agent/description
• agent/severity
• agent/event
• agent/tags
• collector/github-advisory
• package-manager/nuget