Homepage
About Snyk

Untrusted Search Path Affecting panelsw.custom.wix package, versions [,3.15.0-a46)

0.0
high

Snyk CVSS

    Attack Complexity Low
    User Interaction Required
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    Exploit Maturity Proof of concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DOTNET-PANELSWCUSTOMWIX-6483816
  • published 26 Mar 2024
  • disclosed 25 Mar 2024
  • credit Christopher Painter
Report a new vulnerability Found a mistake?

Introduced: 25 Mar 2024

CVE NOT AVAILABLE CWE-426 Open this link in a new tab

How to fix?

Upgrade PanelSW.Custom.WiX to version 3.15.0-a46 or higher.

Overview

Affected versions of this package are vulnerable to Untrusted Search Path due to the use of an unprotected C:\Windows\Temp directory to copy and execute binaries. When a bundle runs as the SYSTEM user, it uses GetTempPathW which points to this insecure directory to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application, resulting in elevation of privileges.

Note:

This is only exploitable if the attacker has the ability to write to the C:\Windows\Temp directory and monitor changes using the ReadDirectoryChangesW API to figure out randomized folder names created inside this directory.