Miggo Logo
Miggo Vulnerability Database
→
GHSA-259p-rvjx-ffwg

GHSA-259p-rvjx-ffwg:
Panel::Software Customized WiX .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

8.3

CVSS Score
3.1

Basic Information

CVE ID
-
GHSA ID
GHSA-259p-rvjx-ffwg
EPSS Score
-
CWE
CWE-426
Published
2/8/2024
Updated
2/8/2024
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
PanelSW.Custom.WiXnuget< 3.15.0-a443.15.0-a44

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key behaviors: (1) using the user's TEMP directory (instead of a secure system location) when not running as admin, and (2) failing to restrict write access to the .be directory. The first function CreateTempDirectory directly creates the insecure .be folder, while the second PathGetTempPath enables the unsafe TEMP selection. Both are critical to the DLL redirection attack vector described in the advisory. The confidence is high because these functions align with the described exploit mechanics (CWE-426) and WiX Burn engine architecture, even without explicit code examples.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

# Summ*ry .** T*MP *ol**r is vuln*r**l* to *LL r**ir**tion *tt**ks t**t *llow t** *tt**k*r to *s**l*t* privil***s. # **t*ils I* t** *un*l* is not run *s **min, t** us*r's T*MP *ol**r is us** *n* not t** syst*m T*MP *ol**r. * utility is **l* to mon

Reasoning

T** vuln*r**ility st*ms *rom two k*y ****viors: (*) usin* t** us*r's T*MP *ir**tory (inst*** o* * s**ur* syst*m lo**tion) w**n not runnin* *s **min, *n* (*) **ilin* to r*stri*t writ* ****ss to t** `.**` *ir**tory. T** *irst *un*tion `*r**t*T*mp*ir**t