PT-2022-27823 · Unknown · Squirrel.Windows

Koh You Liang · Published 2022-12-21 · Updated 2023-01-09 · CVE-2022-46330

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Squirrel.Windows versions 2.0.1 and earlier

Description The issue is related to the DLL search path in installers generated by Squirrel.Windows, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer. Squirrel.Windows is a toolset and library that provides installation and update functionality for Windows desktop applications.

Recommendations For Squirrel.Windows versions 2.0.1 and earlier, update to a version later than 2.0.1 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2022-46330

Affected Products

Squirrel.Windows

References · 9

• https://github.com/Squirrel/Squirrel.Windows/pull/1807 · Patch
• https://osv.dev/vulnerability/CVE-2022-46330 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46330 · Security Note
• https://github.com/Squirrel/Squirrel.Windows · Note
• https://t.me/cibsecurity/55047 · Telegram Post
• https://jvn.jp/en/jp/JVN29902403/index.html · Note
• https://t.me/pentestingnews/31915 · Telegram Post
• https://t.me/cybersecuritytechnologies/7516 · Telegram Post
• https://t.me/cvenotify/40313 · Telegram Post