CVE-2024-29187

highPriorität · verfolgen · 0EPSS 0.005 · 40. PerzentilDEEUNLRUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.46% (40th) EPSS
CVSS 7.3 · high
Is it mine?
25 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-27

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenwago_psirt

    A fix is available with the WAGO Navigator 1.0.2 and is accessible through the WAGO download center.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.3
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.7–7.3

v3.17.3highAV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 1.3 · Auswirkung 5.9
v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · OSV
v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · WAGO PSIRT DE
v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-732USCWE-732USCWE-732USCWE-732USCWE-732US
05

betroffene Produkte (25)

Betroffene Produkte und Versionsbereiche.

20 von 25 angezeigt
06

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

  • NCSC-2024-0250Kwetsbaarheden verholpen in Microsoft Visual StudioNL2024-06-11csaf · ncsc_nlNL

    Microsoft heeft kwetsbaarheden verholpen in Visual Studio.

  • VDE-2024-021WAGO: Vulnerability in WAGO Navigator2024-05-21csaf · wago_psirtDE

    The WAGO Navigator versions 1.0.1 and 1.0 are vulnerable due to the use of the WiX toolset version 3.11.2.

  • WID-SEC-W-2024-1338Microsoft Visual Studio: Mehrere SchwachstellenDeutsch2024-06-11csaf · cert_bundDE

    Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio 2017, Microsoft Visual Studio 2019 und Microsoft Visual Studio 2022 ausnutzen, um seine Privilegien zu erhöhen oder beliebigen Programmcode auszuführen.

  • GHSA-rf39-3f98-xr7rWiX based installers are vulnerable to binary hijack when run as SYSTEM2024-03-25ghsa · osvUS

    ### Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. ### Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. icacls c:\windows\temp **BUILTIN\Users:(CI)(S,WD,AD,X)** BUILTIN\Administrators:(F) BUILTIN\Administrators:(OI)(CI)(IO)(F) NT AUTHORITY\SYSTEM:(F) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) CREATOR OWNER:(OI)(CI)(IO)(F) Built in users(non-administrators) have special permissions to this folder and can create files and write to this directory. While they do not have explicit read permissions, there is a way they can monitor the changes to this directory using ReadDirectoryChangesW API and thus figure out randomized folder names created inside this directory as wel   ### PoC PoC works against the against visual studio enterprise with update 3 [installer ](https://myvs.download.prss.microsoft.com/dbazure/en_visual_studio_enterprise_2015_with_update_3_x86_x64_dvd_8923288.iso?t=8132cd54-4b83-4478-8b73-fd9eb93437bf&P1=1709239640&P2=601&P3=2&P4=iorgKPv%2bG8n2NANTPUVoB92rr8t3W4XM594%2f9BtQQJrYrr8SwxGDxV%2fj%2f2F6Ulto0bXrIaFoZUr4yV37YAsOZVpM29IMtQEO0673AbDVuTe93qDb6wb7xdlpZSse0LZURUwwIFw5cwHQS2ZtvkunXE0osgXtEBT2IzVbPwVH39%2fum854xb4e2Dp61wgNrMZcOLLluBbeA3KX1sP3mm7WAWXBvlFiQWEnTfR5XH5mlLyPy2qfqCXWCjl84jNX7uY%2bpLR1IbfeD2JlcIQNeW2QrvmmqRrRbGvvaCA97IaSjM16XcDqVjvAEGW3sWXUc7y%2fEf68WZIyT7iilaEDUvaqqA%3d%3d&su=1) #### Reproduction steps As a standard user, run the poc. Mount the iso and run visual studio installer as local system account. The PoC should hijack the the binaries dropped by vs installer and a child process "notepad.exe" will be running. ### Impact This is an Elevation of Privilege Vulnerability where a low privileged user can hijack binaries in an unprotected path C:\Windows\Temp to elevate to the SYSTEM user privileges.

07

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducert_bundosvncsc_nlwago_psirtNVDCVE.orgMITRE
veröffentlicht 2024-03-24geändert 2026-06-17
09

Referenzen (12)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan