CVE-2024-29188

Description

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiXs RemoveFolderEx functionality could allow a standard user to delete protected directories. RemoveFolderEx deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed RemoveFolderEx to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5.

Risk Information

Base Score

7.9

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

EPSS Score

Exploitation Probability

0.029

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2024-29187,CVE-2024-29188 are fixed in Nuget - wix 3.14.1	Windows
Vulnerabilities CVE-2024-29187,CVE-2024-29188 are fixed in Nuget - wix 4.0.5	Windows
Vulnerabilities CVE-2024-29188 are fixed in Nuget - WixToolset.Util.wixext 4.0.5	Windows
Vulnerabilities CVE-2024-29187,CVE-2024-29188 are fixed in Nuget - wix for Linux 3.14.1	Linux
Vulnerabilities CVE-2024-29187,CVE-2024-29188 are fixed in Nuget - wix for Linux 4.0.5	Linux
Vulnerabilities CVE-2024-29188 are fixed in Nuget - WixToolset.Util.wixext for Linux 4.0.5	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234