WiX Toolset up to 3.14.0/4.0.4 on Windows Uninstallation RemoveFolderEx link following

Summaryinfo

A vulnerability was found in WiX Toolset up to 3.14.0/4.0.4 on Windows. It has been classified as critical. Impacted is the function RemoveFolderEx of the component Uninstallation Handler. The manipulation leads to link following. This vulnerability is documented as CVE-2024-29188. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in WiX Toolset up to 3.14.0/4.0.4 on Windows and classified as critical. This issue affects the function RemoveFolderEx of the component Uninstallation Handler. The manipulation with an unknown input leads to a link following vulnerability. Using CWE to declare the problem leads to CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-29188 since 03/18/2024. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 3.14.1 or 4.0.5 eliminates this vulnerability. Applying the patch 2e5960b575881567a8807e6b8b9c513138b19742 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• WiX

Name

• Toolset

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14.0
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion