{"id":"CVE-2024-24810","aliases":["GHSA-7wh2-wxc7-9ph5"],"url":"https://o3.security/vulnerability/CVE-2024-24810","summary":"WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges","details":"### Summary\n.be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges.\n\n### Details\nIf the bundle is not run as admin, the user's TEMP folder is used and not the system TEMP folder. A utility is able to monitor the user's TEMP folder for changes and drop its own DLL into the **.be/<bundle>.Local** folder immediately when the .be folder is created. When the burn engine elevates, the malicious DLL receives elevated privileges.\n\n### PoC\nAs a standard, non-admin user:\n1. Monitor the user's TEMP folder for changes using ReadDirectoryChangesW\n2. On FILE_ACTION_ADDED, check if the folder name is .be\n3. Create a folder in .be named after the bundle + .Local (e.g. MyInstaller.exe.Local)\n4. Put the malicious COMCTL32.DLL in the .Local folder following the naming used for the real DLL (e.g. MyInstaller.exe.Local/x86_microsoft.windows.common-controls_.../COMCTL32.dll)\n5. Do hacker things when the engine escalates and the malicious DLL is loaded\n\nProper naming for the path can be obtained by using GetModuleHandle(\"comctl32.dll\") and GetModuleFileName.\n\n### Impact\nDLL redirection utilizing .exe.Local Windows capability. This impacts any installer built with the WiX installer framework.","published":"2024-02-07T02:39:35.627Z","modified":"2026-08-12T03:51:13.785795322Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"wix","fixedVersion":"4.0.4"},{"ecosystem":"NuGet","name":"wix","fixedVersion":"3.14.0"}],"fix":{"url":"https://github.com/wixtoolset/wix/commit/fec38b6461d0551339139a2fe52403a61942adc0","label":"wixtoolset/wix@fec38b6"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24810.json"},{"type":"ADVISORY","url":"https://github.com/wixtoolset/issues/security/advisories/GHSA-7wh2-wxc7-9ph5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24810"},{"type":"WEB","url":"https://github.com/wixtoolset/wix/commit/fec38b6461d0551339139a2fe52403a61942adc0"},{"type":"PACKAGE","url":"https://github.com/wixtoolset/wix"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:13.785795322Z"}}