Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-27303

CVE-2024-27303: electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)

7.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-27303
GHSA ID
GHSA-r4pf-3v7r-hh55
EPSS Score
0.19096%
CWE
CWE-426
Published
3/4/2024
Updated
3/16/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
app-builder-libnpm< 24.13.224.13.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from NSIS script commands using 'cmd' without full path in three locations. The patch explicitly replaces 'cmd' with '%SYSTEMROOT%\System32\cmd.exe' to enforce using the system's legitimate command interpreter. The affected code was in macros handling process management during installation, making them the vulnerable functions. High confidence comes from direct correlation between patched lines and CWE-426/CWE-427 descriptions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Win*ows-Only: T** NSIS inst*ll*r m*k*s * syst*m **ll to op*n *m*.*x* vi* NS*x** in t** `.ns*` inst*ll*r s*ript. NS*x** *y ****ult s**r***s t** *urr*nt *ir**tory o* w**r* t** inst*ll*r is lo**t** ***or* s**r**in* `P*T*`. T*is m**ns t**t i*

Reasoning

T** vuln*r**ility st*ms *rom NSIS s*ript *omm*n*s usin* '*m*' wit*out *ull p*t* in t*r** lo**tions. T** p*t** *xpli*itly r*pl***s '*m*' wit* '%SYST*MROOT%\Syst*m**\*m*.*x*' to *n*or** usin* t** syst*m's l**itim*t* *omm*n* int*rpr*t*r. T** *****t** *o