CVE-2024-29188
Description
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5.
How to fix
- wix3.14.1, 4.0.5 or later
- WixToolset.Util.wixext4.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wixNuGet | v < 3.14.1, 4.0.0 ≤ v < 4.0.5 | 3.14.1, 4.0.5 |
| WixToolset.Util.wixextNuGet | v < 4.0.5 | 4.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.