Vulnerability in WiX toolset could allow attackers to bypass protection of sensitive directories
CVE-2024-29188

7.8HIGH

Key Information:

Vendor: Wixtoolset
Status: Issues
Vendor: CVE Published:; 24 March 2024

What is CVE-2024-29188?

The WiX Toolset allows developers to create Windows Installer packages, but a vulnerability exists in the RemoveFolderEx functionality. This issue can enable unauthorized deletion of protected directories by standard users if proper safeguards are not implemented. Specifically, an attacker can exploit this flaw by creating a directory junction in a per-user folder that points to a protected directory within the per-machine context. When the Windows Installer executes a per-machine installer, it bypasses user permissions and may delete crucial system directories, potentially harming system integrity and exposing the system to further risks. Mitigating this issue is essential for maintaining secure installation practices, and the vulnerability has been addressed in versions 3.14.1 and 4.0.5 of the WiX Toolset.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch