PT-2024-40286 · Microsoft · Visual Studio Enterprise

Published 2024-03-25 · Updated 2024-03-25

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Burn versions (affected versions not specified)

Description: The issue concerns an Elevation of Privilege Vulnerability where a low-privileged user can hijack binaries in an unprotected path, specifically the C:WindowsTemp directory, to elevate to the SYSTEM user privileges. This directory is not entirely protected against low-privilege users, allowing them to create files and write to this directory. Although they do not have explicit read permissions, they can monitor changes to this directory using the ReadDirectoryChangesW API, enabling them to figure out randomized folder names created inside this directory. The vulnerability can be exploited by a standard user running a Proof of Concept (PoC) against the Visual Studio Enterprise with Update 3 installer, resulting in the hijacking of binaries dropped by the installer and the execution of a child process, such as notepad.exe, with elevated privileges.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-G4V6-69P6-Q3P4

Affected Products

Visual Studio Enterprise

References · 4

• https://osv.dev/vulnerability/GHSA-g4v6-69p6-q3p4 · Vendor Advisory
• https://github.com/nirbar/wix4 · Note
• https://github.com/nirbar/wix4/commit/0410df93a5f29e4235b4b78b90a1384ffafd062b · Note
• https://github.com/nirbar/wix4/security/advisories/GHSA-g4v6-69p6-q3p4 · Note