{"answers":{"affected":"2 open source packages ship an affected version, including PanelSwWix4.Sdk.","exploited":"There is no known exploitation of GHSA-g4v6-69p6-q3p4 in the wild and no public exploit code.","fix":"Upgrade PanelSwWix4.Sdk to 5.0.0-psw-wix.0265-49 or later.","what":"GHSA-g4v6-69p6-q3p4 is a vulnerability in PanelSwWix4.Sdk, published on 25 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-g4v6-69p6-q3p4 and fix it if it is affected.\n\nWhat it is: GHSA-g4v6-69p6-q3p4 is a vulnerability in PanelSwWix4.Sdk, published on 25 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-g4v6-69p6-q3p4 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- PanelSwWix4.Sdk (NuGet): affected all versions; fixed in 5.0.0-psw-wix.0265-49\n- PanelSwWix4.Sdk (NuGet): affected all versions; fixed in 5.0.0-psw-wix.0265-49\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-g4v6-69p6-q3p4/ (Markdown: https://insights.sbomify.com/GHSA-g4v6-69p6-q3p4/index.md)","id":"GHSA-g4v6-69p6-q3p4","markdown":"https://insights.sbomify.com/GHSA-g4v6-69p6-q3p4/index.md","name":"GHSA-g4v6-69p6-q3p4","record":{"aliases":[],"analysis":{"component_type":"developer_tool","fix_type":"patch","impacts":["privilege_escalation","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"WiX Burn installer","requires_auth":"low_privilege","summary":"Low-privilege users can hijack binaries in C:\\Windows\\Temp during SYSTEM-level WiX Burn installations to execute arbitrary code and escalate privileges.","user_interaction":"required","vuln_class":"privilege_escalation"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"# Summary\n\nBurn uses an unprotected C:\\Windows\\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users.\n\n# Details\n\nWhen a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\\Windows\\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges.\n\n```\nicacls c:\\windows\\temp\n\nBUILTIN\\Users:(CI)(S,WD,AD,X)\nBUILTIN\\Administrators:(F)\nBUILTIN\\Administrators:(OI)(CI)(IO)(F)\nNT AUTHORITY\\SYSTEM:(F)\nNT AUTHORITY\\SYSTEM:(OI)(CI)(IO)(F)\nCREATOR OWNER:(OI)(CI)(IO)(F)\n```\n\nBuilt in users(non-administrators) have special permissions to this folder and can create files and write to this directory. While they do not have explicit read permissions, there is a way they can monitor the changes to this directory using ReadDirectoryChangesW API and thus figure out randomized folder names created inside this directory as wel\n \n# PoC\n\nPoC works against the against visual studio enterprise with update 3 installer\n\n## Reproduction steps\n\nAs a standard user, run the poc.\nMount the iso and run visual studio [installer ](https://myvs.download.prss.microsoft.com/dbazure/en_visual_studio_enterprise_2015_with_update_3_x86_x64_dvd_8923288.iso?t=8132cd54-4b83-4478-8b73-fd9eb93437bf\u0026P1=1709239640\u0026P2=601\u0026P3=2\u0026P4=iorgKPv%2bG8n2NANTPUVoB92rr8t3W4XM594%2f9BtQQJrYrr8SwxGDxV%2fj%2f2F6Ulto0bXrIaFoZUr4yV37YAsOZVpM29IMtQEO0673AbDVuTe93qDb6wb7xdlpZSse0LZURUwwIFw5cwHQS2ZtvkunXE0osgXtEBT2IzVbPwVH39%2fum854xb4e2Dp61wgNrMZcOLLluBbeA3KX1sP3mm7WAWXBvlFiQWEnTfR5XH5mlLyPy2qfqCXWCjl84jNX7uY%2bpLR1IbfeD2JlcIQNeW2QrvmmqRrRbGvvaCA97IaSjM16XcDqVjvAEGW3sWXUc7y%2fEf68WZIyT7iilaEDUvaqqA%3d%3d\u0026su=1)as local system account.\nThe PoC should hijack the the binaries dropped by vs installer and a child process \"notepad.exe\" will be running.\n\n# Impact\n\nThis is an Elevation of Privilege Vulnerability where a low privileged user can hijack binaries in an unprotected path C:\\Windows\\Temp to elevate to the SYSTEM user privileges.","ecosystems":["NuGet"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM","id":"GHSA-g4v6-69p6-q3p4","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"NuGet","product":null,"products":[],"type":"privilege_escalation","year":"2024"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"NuGet","fixed":["5.0.0-psw-wix.0265-49"],"introduced":["0"],"last_affected":[],"package":"PanelSwWix4.Sdk","purl":null,"source":"GHSA-g4v6-69p6-q3p4"},{"ecosystem":"NuGet","fixed":["5.0.0-psw-wix.0265-49"],"introduced":["0"],"last_affected":[],"package":"PanelSwWix4.Sdk","purl":"pkg:nuget/PanelSwWix4.Sdk","source":"GHSA-g4v6-69p6-q3p4"}],"products":null,"published":"2024-03-25","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Low-privilege users can hijack binaries in C:\\Windows\\Temp during SYSTEM-level WiX Burn installations to execute arbitrary code and escalate privileges.","url":"https://insights.sbomify.com/GHSA-g4v6-69p6-q3p4/"}