PT-2024-40505 · Burn · Burn

Published 2024-03-25 · Updated 2024-03-25

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Burn versions (affected versions not specified)

Description The issue concerns the use of an unprotected directory, C:WindowsTemp, by Burn to copy and run binaries. This directory is accessible to low-privilege users, who can hijack binaries before they are loaded, resulting in elevation of privileges. The BUILTINUsers group has special permissions to this folder, allowing them to create files and write to the directory. Although they do not have explicit read permissions, they can monitor changes to the directory using the ReadDirectoryChangesW API. This vulnerability can be exploited by a low-privileged user to elevate their privileges to the SYSTEM user level.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-WQ88-FQ4X-H2PM

Affected Products

Burn

References · 4

• https://osv.dev/vulnerability/GHSA-wq88-fq4x-h2pm · Vendor Advisory
• https://github.com/nirbar/wix3/commit/99e754bbc717c61f18862aefd98c035f5e2f848d · Note
• https://github.com/nirbar/wix3 · Note
• https://github.com/nirbar/wix3/security/advisories/GHSA-wq88-fq4x-h2pm · Note