WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When
    a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp
    to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the
    application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.
    (CVE-2024-29187)

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including:

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2024-29060, CVE-2024-29187)

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2024-30052)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Wix Toolset installed on the remote host is prior to 3.14.1 or 4.x prior to 4.0.5. It is, therefore, affected by multiple vulnerabilities.

  - The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete     protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or     uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding     each subdirectory to the list of directories Windows Installer should delete. If the setup author     instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could     create a directory junction in that per-user folder pointing to a per-machine, protected directory.
    Windows Installer, when executing the per-machine installer after approval by an administrator, would     delete the target of the directory junction. (CVE-2024-29188)

  - When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory     C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's     loaded in the application resulting in elevation of privileges. (CVE-2024-29187)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
418682	SCA: security update for WixToolset.Sdk, wix (GHSA-rf39-3f98-xr7r)	Tenable Cloud Security	SCA Checks	high
418682	SCA: security update for WixToolset.Sdk, wix (GHSA-rf39-3f98-xr7r)	Tenable Self-Hosted Container Security	SCA Checks	high
200353	Security Updates for Microsoft Visual Studio Products (June 2024)	Nessus	Windows : Microsoft Bulletins	medium
192645	Wix Toolset < 3.14.1 / 4.x < 4.0.5 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2024-29187

high

Tenable Plugins

high

high

medium

high