WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The
    custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected
    directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It
    does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to
    the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx`
    to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in
    that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the
    per-machine installer after approval by an administrator, would delete the target of the directory
    junction. This vulnerability is fixed in 3.14.1 and 4.0.5. (CVE-2024-29188)

The version of Wix Toolset installed on the remote host is prior to 3.14.1 or 4.x prior to 4.0.5. It is, therefore, affected by multiple vulnerabilities.

  - The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete     protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or     uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding     each subdirectory to the list of directories Windows Installer should delete. If the setup author     instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could     create a directory junction in that per-user folder pointing to a per-machine, protected directory.
    Windows Installer, when executing the per-machine installer after approval by an administrator, would     delete the target of the directory junction. (CVE-2024-29188)

  - When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory     C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's     loaded in the application resulting in elevation of privileges. (CVE-2024-29187)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
416622	SCA: security update for WixToolset.Util.wixext, wix (GHSA-jx4p-m4wm-vvjg)	Tenable Cloud Security	SCA Checks	high
416622	SCA: security update for WixToolset.Util.wixext, wix (GHSA-jx4p-m4wm-vvjg)	Tenable Self-Hosted Container Security	SCA Checks	high
192645	Wix Toolset < 3.14.1 / 4.x < 4.0.5 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2024-29188

high

Tenable Plugins

high

high

high