All the vulnerabilites related to wixtoolset - issues
cve-2024-29187
Vulnerability from cvelistv5
Published
2024-03-24 19:38
Modified
2024-08-13 14:28
Severity ?
EPSS score ?
Summary
WiX based installers are vulnerable to binary hijack when run as SYSTEM
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r | x_refsource_CONFIRM | |
| https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7 | x_refsource_MISC | |
| https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9 | x_refsource_MISC |
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| wixtoolset | issues |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:54.048Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r"
},
{
"name": "https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7"
},
{
"name": "https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:wixtoolset_project:burn:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "burn",
"vendor": "wixtoolset_project",
"versions": [
{
"lessThan": "3.14.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.0.5",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29187",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-13T14:26:34.154132Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-13T14:28:49.838Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "issues",
"vendor": "wixtoolset",
"versions": [
{
"status": "affected",
"version": "\u003c 3.14.1"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\\Windows\\Temp to drop and load multiple binaries. Standard users can hijack the binary before it\u0027s loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-24T19:46:06.327Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r"
},
{
"name": "https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7"
},
{
"name": "https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9"
}
],
"source": {
"advisory": "GHSA-rf39-3f98-xr7r",
"discovery": "UNKNOWN"
},
"title": "WiX based installers are vulnerable to binary hijack when run as SYSTEM"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-29187",
"datePublished": "2024-03-24T19:38:38.140Z",
"dateReserved": "2024-03-18T17:07:00.094Z",
"dateUpdated": "2024-08-13T14:28:49.838Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-24810
Vulnerability from cvelistv5
Published
2024-02-07 02:39
Modified
2024-08-01 23:28
Severity ?
EPSS score ?
Summary
WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/wixtoolset/issues/security/advisories/GHSA-7wh2-wxc7-9ph5 | x_refsource_CONFIRM |
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| wixtoolset | issues |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:firegiant:wix_toolset:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wix_toolset",
"vendor": "firegiant",
"versions": [
{
"lessThan": "3.14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:firegiant:wix_toolset:4.0.0:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wix_toolset",
"vendor": "firegiant",
"versions": [
{
"lessThan": "4.0.4",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-24810",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T19:18:57.581197Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-15T20:58:05.182Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:28:12.588Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/wixtoolset/issues/security/advisories/GHSA-7wh2-wxc7-9ph5",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-7wh2-wxc7-9ph5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "issues",
"vendor": "wixtoolset",
"versions": [
{
"status": "affected",
"version": "\u003c= 4.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been patched in version 4.0.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-426",
"description": "CWE-426: Untrusted Search Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-07T02:39:35.627Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/wixtoolset/issues/security/advisories/GHSA-7wh2-wxc7-9ph5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-7wh2-wxc7-9ph5"
}
],
"source": {
"advisory": "GHSA-7wh2-wxc7-9ph5",
"discovery": "UNKNOWN"
},
"title": "WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-24810",
"datePublished": "2024-02-07T02:39:35.627Z",
"dateReserved": "2024-01-31T16:28:17.941Z",
"dateUpdated": "2024-08-01T23:28:12.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-29188
Vulnerability from cvelistv5
Published
2024-03-24 19:46
Modified
2024-08-02 01:10
Severity ?
EPSS score ?
Summary
Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/wixtoolset/issues/security/advisories/GHSA-jx4p-m4wm-vvjg | x_refsource_CONFIRM | |
| https://github.com/wixtoolset/wix/commit/2e5960b575881567a8807e6b8b9c513138b19742 | x_refsource_MISC | |
| https://github.com/wixtoolset/wix3/commit/93eeb5f6835776694021f66d4226c262c67d487a | x_refsource_MISC |
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| wixtoolset | issues |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29188",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-28T18:20:54.492822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:57:33.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:54.532Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/wixtoolset/issues/security/advisories/GHSA-jx4p-m4wm-vvjg",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-jx4p-m4wm-vvjg"
},
{
"name": "https://github.com/wixtoolset/wix/commit/2e5960b575881567a8807e6b8b9c513138b19742",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/wixtoolset/wix/commit/2e5960b575881567a8807e6b8b9c513138b19742"
},
{
"name": "https://github.com/wixtoolset/wix3/commit/93eeb5f6835776694021f66d4226c262c67d487a",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/wixtoolset/wix3/commit/93eeb5f6835776694021f66d4226c262c67d487a"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "issues",
"vendor": "wixtoolset",
"versions": [
{
"status": "affected",
"version": "\u003c 3.14.1"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX\u0027s `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-24T19:46:25.875Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/wixtoolset/issues/security/advisories/GHSA-jx4p-m4wm-vvjg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-jx4p-m4wm-vvjg"
},
{
"name": "https://github.com/wixtoolset/wix/commit/2e5960b575881567a8807e6b8b9c513138b19742",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/wixtoolset/wix/commit/2e5960b575881567a8807e6b8b9c513138b19742"
},
{
"name": "https://github.com/wixtoolset/wix3/commit/93eeb5f6835776694021f66d4226c262c67d487a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/wixtoolset/wix3/commit/93eeb5f6835776694021f66d4226c262c67d487a"
}
],
"source": {
"advisory": "GHSA-jx4p-m4wm-vvjg",
"discovery": "UNKNOWN"
},
"title": "Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-29188",
"datePublished": "2024-03-24T19:46:25.875Z",
"dateReserved": "2024-03-18T17:07:00.094Z",
"dateUpdated": "2024-08-02T01:10:54.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}