CVE-2024-29187
CVE-2024-29187 is a privilege escalation vulnerability in the WiX toolset. This flaw allows standard users to potentially hijack binaries and gain elevated privileges. When a WiX bundle operates as the SYSTEM user, it utilizes an insecure temporary directory (C:\Windows\Temp) to store and load multiple binary files. With an SVRS score of 30, the urgency is moderate, but should still be addressed. This vulnerability, classified as CWE-732, can be exploited by malicious users to gain SYSTEM-level access. The risk associated with CVE-2024-29187 is significant because successful exploitation allows an attacker to bypass security restrictions. Upgrade to WiX toolset versions 3.14.1 or 4.0.5 to mitigate this security risk. The fact that it is tagged as "In The Wild" means active exploitation is possible.
Description:
CVE-2024-29187 is a privilege escalation vulnerability in the WiX toolset, which allows standard users to elevate their privileges to SYSTEM level. This is due to the insecure use of GetTempPathW, which points to an insecure directory where binaries are dropped and loaded.
Key Insights:
- SVRS Score: 46, indicating a moderate risk.
- Exploit Status: Active exploits have been published.
- CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.
- In the Wild: The vulnerability is actively exploited by hackers.
Mitigation Strategies:
- Update to WiX toolset version 3.14.1 or 4.0.5.
- Restrict access to the insecure directory (C:\Windows\Temp).
- Implement least privilege principles to limit the impact of potential exploits.
- Monitor for suspicious activity and implement intrusion detection systems.
Additional Information:
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.