Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.
Nullsoft Scriptable Install System (NSIS) anterior a la versión 3.11 en Windows permite a los usuarios locales escalar privilegios a SYSTEM durante una instalación, ya que el directorio temporal de complementos se crea en %WINDIR%\temp y los usuarios sin privilegios pueden colocar un archivo ejecutable manipulado al superar una condición de ejecución. Esto ocurre porque EW_CREATEDIR no siempre activa el indicador de error CreateRestrictedDirectory.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | CHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-754
|