Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files

CAO 7.9CVE-2024-29188 · GHSA-jx4p-m4wm-vvjg · Công bố 24/03/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-29188 là lỗ hổng mức CAO (CVSS 7.9) ảnh hưởng WixToolset.Util.wixext, wix.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.24%, cao hơn 15.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.0.5, 3.14.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
WixToolset.Util.wixext NuGet	`< 4.0.5`	`4.0.5`
wix NuGet	`≥ 4.0.0, < 4.0.5< 3.14.1`	`4.0.53.14.1`

Mô tả

Summary

The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories.

Details

RemoveFolderEx deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed RemoveFolderEx to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction.

Mô tả của NVD

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5.