{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "PanelSW.Custom.WiX"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15.0-a44"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-426"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-08T18:24:21Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "# Summary\n\n.be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges.\n\n# Details\n\nIf the bundle is not run as admin, the user\u0027s TEMP folder is used and not the system TEMP folder. A utility is able to monitor the user\u0027s TEMP folder for changes and drop its own DLL into the .be/.Local folder immediately when the .be folder is created. When the burn engine elevates, the malicious DLL receives elevated privileges.\n\n# PoC\n\nAs a standard, non-admin user:\n\n1.  Monitor the user\u0027s TEMP folder for changes using ReadDirectoryChangesW\n1.  On FILE_ACTION_ADDED, check if the folder name is .be\n1.  Create a folder in .be named after the bundle + .Local (e.g. MyInstaller.exe.Local)\n1.  Put the malicious COMCTL32.DLL in the .Local folder following the naming used for the real DLL (e.g. MyInstaller.exe.Local/x86_microsoft.windows.common-controls_.../COMCTL32.dll)\n1.  Do hacker things when the engine escalates and the malicious DLL is loaded\n\nProper naming for the path can be obtained by using GetModuleHandle(\"comctl32.dll\") and GetModuleFileName.\n\n# Impact\n\nDLL redirection utilizing .exe.Local Windows capability. This impacts any installer built with the WiX installer framework.\n",
  "id": "GHSA-259p-rvjx-ffwg",
  "modified": "2024-02-08T18:24:21Z",
  "published": "2024-02-08T18:24:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nirbar/wix3/security/advisories/GHSA-259p-rvjx-ffwg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nirbar/wix3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Panel::Software Customized WiX .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges"
}