CVE-2024-29188 Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
Attackers can delete protected system files via directory junctions in WiX installers, requiring admin approval for execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-29188?
CVE-2024-29188 is a high-severity path traversal vulnerability in wixtoolset issues, published on 24 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5.
Weakness: CWE-59
Which versions are affected by CVE-2024-29188?
6 open source packages ship an affected version, including WixToolset.Util.wixext and wix.
| Package | Affected | Fixed in |
|---|---|---|
WixToolset.Util.wixext NuGet | All versions | 4.0.5 |
WixToolset.Util.wixext NuGet | All versions | 4.0.5 |
wix NuGet | All versions | 3.14.1 |
wix NuGet | All versions | 3.14.1 |
wix NuGet | From 4.0.0 | 4.0.5 |
wix NuGet | From 4.0.0 | 4.0.5 |
How do I fix CVE-2024-29188?
Upgrade WixToolset.Util.wixext to 4.0.5 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-29188 being exploited?
There is no known exploitation of CVE-2024-29188 in the wild and no public exploit code.
Sources
Also known as GHSA-jx4p-m4wm-vvjg.