Untrusted Search Path Affecting panelsw.custom.wix package, versions [,3.15.0-a46)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-PANELSWCUSTOMWIX-6483816
- published 26 Mar 2024
- disclosed 25 Mar 2024
- credit Christopher Painter
How to fix?
Upgrade PanelSW.Custom.WiX to version 3.15.0-a46 or higher.
Overview
Affected versions of this package are vulnerable to Untrusted Search Path due to the use of an unprotected C:\Windows\Temp directory to copy and execute binaries. When a bundle runs as the SYSTEM user, it uses GetTempPathW which points to this insecure directory to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application, resulting in elevation of privileges.
Note:
This is only exploitable if the attacker has the ability to write to the C:\Windows\Temp directory and monitor changes using the ReadDirectoryChangesW API to figure out randomized folder names created inside this directory.