CVE-2024-24810 Overview
CVE-2024-24810 is a local privilege escalation vulnerability in the WiX toolset, a widely used framework for building Windows Installer packages. The .be (burn engine) TEMP folder used during installation is vulnerable to DLL redirection attacks. A local attacker who can place a malicious DLL in the predictable TEMP location can hijack the DLL search order and execute code in the elevated context of the installer. Any installer produced with the WiX framework is affected. The issue is tracked under CWE-426: Untrusted Search Path and patched in WiX toolset version 4.0.4.
Critical Impact
Local attackers can hijack DLLs loaded from the WiX burn engine TEMP directory to escalate privileges and execute arbitrary code with the installer's elevated permissions.
Affected Products
- Firegiant WiX Toolset versions prior to 4.0.4
- Any Windows installer package built with a vulnerable WiX version
- Applications distributing installers that rely on the WiX burn engine
Discovery Timeline
- 2024-02-07 - CVE-2024-24810 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-24810
Vulnerability Analysis
The WiX toolset generates bootstrapper applications that use a burn engine to orchestrate chained installations. During execution, the burn engine unpacks payloads to a .be subdirectory inside the Windows TEMP folder. This location is writable by standard users, but the installer process itself runs with elevated privileges when the package requests administrative rights.
Because the burn engine loads DLLs from this attacker-writable path without validating the trust of those binaries, an unprivileged local user can pre-stage a malicious DLL with a name matching one the installer resolves. When the elevated installer loads the planted library, the attacker's code runs in the installer's security context, resulting in privilege escalation from a standard user to the elevated identity used by the installation.
The flaw impacts the installer framework itself, meaning every downstream product built with a vulnerable WiX version inherits the weakness until rebuilt with a patched release.
Root Cause
The root cause is an untrusted search path condition [CWE-426]. The burn engine resolves and loads dependent DLLs from a directory whose access control does not prevent unprivileged users from writing to it. Combined with the elevation performed by the installer, this creates a classic DLL planting primitive.
Attack Vector
Exploitation requires local access and user interaction because the victim must launch an installer built with a vulnerable WiX version. The attacker writes a crafted DLL into the burn engine's .be TEMP directory before or during installer execution. When the elevated bootstrapper loads the DLL, the payload runs with the installer's privileges, providing a path to SYSTEM in many real-world configurations. No network exposure is required, and no authentication to the target application is needed beyond a standard local user session.
No public proof-of-concept or exploit code is listed for this CVE. Refer to the WiX Toolset GitHub Security Advisory GHSA-7wh2-wxc7-9ph5 for maintainer details.
Detection Methods for CVE-2024-24810
Indicators of Compromise
- Unexpected DLL files written to %TEMP%\.be\ or child directories immediately before or during execution of a WiX-built installer.
- Installer or bootstrapper processes loading DLLs from user-writable TEMP paths rather than from Program Files or the package cache.
- Child processes spawned by a WiX bootstrapper (*.exe with burn engine strings) that run with elevated tokens and originate from %TEMP%.
Detection Strategies
- Monitor process image loads for elevated installer executables reading DLLs from %TEMP%\.be or similar user-writable directories.
- Enable Windows Defender Application Control or AppLocker DLL rules to log or block DLL loads from TEMP directories by elevated processes.
- Correlate Sysmon Event ID 7 (Image Loaded) with Event ID 1 (Process Create) to identify anomalous DLL loads by MSI bootstrappers.
Monitoring Recommendations
- Inventory endpoints for installers and applications packaged with WiX versions earlier than 4.0.4.
- Alert on file-creation events in %TEMP%\.be by non-installer processes, particularly DLLs matching common Windows library names.
- Track token elevation events (Event ID 4673/4688) tied to processes launched from TEMP.
How to Mitigate CVE-2024-24810
Immediate Actions Required
- Upgrade the WiX toolset to version 4.0.4 or later and rebuild all affected installers.
- Redistribute patched installers to customers and internal users, replacing any previously shipped vulnerable packages.
- Audit software supply chain artifacts to identify third-party installers built with vulnerable WiX versions and request updated builds from vendors.
Patch Information
The issue is fixed in WiX toolset 4.0.4. Details are published in the WiX Toolset GitHub Security Advisory GHSA-7wh2-wxc7-9ph5. Developers must rebuild their bootstrapper packages against the patched version because the vulnerability exists in the burn engine embedded in each installer, not in a runtime library that can be replaced independently.
Workarounds
- Restrict interactive logon on servers and multi-user systems so untrusted users cannot stage payloads in TEMP before an administrator runs an installer.
- Apply AppLocker or WDAC policies that deny DLL loads from user-writable TEMP paths for elevated processes until installers are rebuilt.
- Where feasible, run installations from clean, single-user sessions and remove pre-existing content from %TEMP%\.be before launching a WiX bootstrapper.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
