{"id":"GHSA-8v28-3g86-chj5","aliases":[],"url":"https://o3.security/vulnerability/GHSA-8v28-3g86-chj5","summary":"PanelSwWix4.Sdk  .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges","details":"# Summary\n\n.be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges.\n\n# Details\n\nIf the bundle is not run as admin, the user's TEMP folder is used and not the system TEMP folder. A utility is able to monitor the user's TEMP folder for changes and drop its own DLL into the .be/.Local folder immediately when the .be folder is created. When the burn engine elevates, the malicious DLL receives elevated privileges.\n\n# PoC\n\nAs a standard, non-admin user:\n\n1.  Monitor the user's TEMP folder for changes using ReadDirectoryChangesW\n1.  On FILE_ACTION_ADDED, check if the folder name is .be\n1.  Create a folder in .be named after the bundle + .Local (e.g. MyInstaller.exe.Local)\n1.  Put the malicious COMCTL32.DLL in the .Local folder following the naming used for the real DLL (e.g. MyInstaller.exe.Local/x86_microsoft.windows.common-controls_.../COMCTL32.dll)\n1.  Do hacker things when the engine escalates and the malicious DLL is loaded\n\nProper naming for the path can be obtained by using GetModuleHandle(\"comctl32.dll\") and GetModuleFileName.\n\n# Impact\n\nDLL redirection utilizing .exe.Local Windows capability. This impacts any installer built with the WiX installer framework.\n","published":"2024-02-08T18:24:35Z","modified":"2024-02-08T18:24:35Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"PanelSwWix4.Sdk","fixedVersion":"5.0.0-psw-wix.0251-40"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/nirbar/wix4/security/advisories/GHSA-8v28-3g86-chj5"},{"type":"PACKAGE","url":"https://github.com/nirbar/wix4"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-02-08T18:24:35Z"}}