# GHSA-g4v6-69p6-q3p4: WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM

> Low-privilege users can hijack binaries in C:\Windows\Temp during SYSTEM-level WiX Burn installations to execute arbitrary code and escalate privileges.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 25 Mar 2024

## What is GHSA-g4v6-69p6-q3p4?

GHSA-g4v6-69p6-q3p4 is a vulnerability in PanelSwWix4.Sdk, published on 25 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

# Summary

Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users.

# Details

When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges.

```
icacls c:\windows\temp

BUILTIN\Users:(CI)(S,WD,AD,X)
BUILTIN\Administrators:(F)
BUILTIN\Administrators:(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(F)
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
CREATOR OWNER:(OI)(CI)(IO)(F)
```

Built in users(non-administrators) have special permissions to this folder and can create files and write to this directory. While they do not have explicit read permissions, there is a way they can monitor the changes to this directory using ReadDirectoryChangesW API and thus figure out randomized folder names created inside this directory as wel
 
# PoC

PoC works against the against visual studio enterprise with update 3 installer

## Reproduction steps

As a standard user, run the poc.
Mount the iso and run visual studio [installer ](https://myvs.download.prss.microsoft.com/dbazure/en_visual_studio_enterprise_2015_with_update_3_x86_x64_dvd_8923288.iso?t=8132cd54-4b83-4478-8b73-fd9eb93437bf&P1=1709239640&P2=601&P3=2&P4=iorgKPv%2bG8n2NANTPUVoB92rr8t3W4XM594%2f9BtQQJrYrr8SwxGDxV%2fj%2f2F6Ulto0bXrIaFoZUr4yV37YAsOZVpM29IMtQEO0673AbDVuTe93qDb6wb7xdlpZSse0LZURUwwIFw5cwHQS2ZtvkunXE0osgXtEBT2IzVbPwVH39%2fum854xb4e2Dp61wgNrMZcOLLluBbeA3KX1sP3mm7WAWXBvlFiQWEnTfR5XH5mlLyPy2qfqCXWCjl84jNX7uY%2bpLR1IbfeD2JlcIQNeW2QrvmmqRrRbGvvaCA97IaSjM16XcDqVjvAEGW3sWXUc7y%2fEf68WZIyT7iilaEDUvaqqA%3d%3d&su=1)as local system account.
The PoC should hijack the the binaries dropped by vs installer and a child process "notepad.exe" will be running.

# Impact

This is an Elevation of Privilege Vulnerability where a low privileged user can hijack binaries in an unprotected path C:\Windows\Temp to elevate to the SYSTEM user privileges.

## Which versions are affected by GHSA-g4v6-69p6-q3p4?

2 open source packages ship an affected version, including PanelSwWix4.Sdk.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `PanelSwWix4.Sdk` | NuGet | All versions | 5.0.0-psw-wix.0265-49 |
| `PanelSwWix4.Sdk` | NuGet | All versions | 5.0.0-psw-wix.0265-49 |

## How do I fix GHSA-g4v6-69p6-q3p4?

Upgrade PanelSwWix4.Sdk to 5.0.0-psw-wix.0265-49 or later.

## Is GHSA-g4v6-69p6-q3p4 being exploited?

There is no known exploitation of GHSA-g4v6-69p6-q3p4 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-g4v6-69p6-q3p4 and fix it if it is affected.

What it is: GHSA-g4v6-69p6-q3p4 is a vulnerability in PanelSwWix4.Sdk, published on 25 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of GHSA-g4v6-69p6-q3p4 in the wild and no public exploit code.

Affected packages and fixed versions:
- PanelSwWix4.Sdk (NuGet): affected all versions; fixed in 5.0.0-psw-wix.0265-49
- PanelSwWix4.Sdk (NuGet): affected all versions; fixed in 5.0.0-psw-wix.0265-49

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-g4v6-69p6-q3p4/ (Markdown: https://insights.sbomify.com/GHSA-g4v6-69p6-q3p4/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-g4v6-69p6-q3p4

---
From sbomify Insights: https://insights.sbomify.com/GHSA-g4v6-69p6-q3p4/
Summaries are generated and may contain mistakes; the official description above is the record.