CVE-2024-29188
CVE-2024-29188 is a directory junction vulnerability in the WiX toolset that could allow a standard user to delete protected directories. This flaw exists because the RemoveFolderEx custom action in WiX doesn't properly validate directory permissions. If misused, this function can lead to unauthorized deletion of system files.
The vulnerability, present in versions prior to 3.14.1 and 4.0.5, allows a malicious user to create a directory junction within a per-user folder, pointing to a protected, per-machine directory. Although the CVSS score is 0, indicating no immediate risk, SOCRadar's Vulnerability Risk Score (SVRS) of 30, and the presence of the "In The Wild" tag, suggests some level of exploitation activity, even if limited. Successful exploitation requires administrator approval during installation or uninstallation, mitigating the immediate threat level. Updating to WiX toolset version 3.14.1 or 4.0.5 is crucial to mitigate this security risk and prevent potential data loss or system compromise.
Description:
CVE-2024-29188 affects the WiX toolset, allowing standard users to delete protected directories. This vulnerability arises from the RemoveFolderEx functionality, which deletes directory trees during installation or uninstallation. By creating a directory junction in a per-user folder pointing to a per-machine, protected directory, attackers can exploit this vulnerability to delete the target of the directory junction.
Key Insights:
- SVRS Score: 42, indicating a moderate risk.
- Exploit Status: Active exploits have been published.
- CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.
- In the Wild: The vulnerability is actively exploited by hackers.
Mitigation Strategies:
- Update WiX to version 3.14.1 or 4.0.5.
- Review and restrict the use of
RemoveFolderExin WiX projects. - Implement access controls to prevent standard users from modifying protected directories.
- Monitor systems for suspicious activity and apply security patches promptly.
Additional Information:
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.