Last week NSIS released a new version which addresses a privilege escalation issue I reported (CVE-2023-37378).
Its an interesting one which affects certain setups where you can trigger an uninstaller as SYSTEM. I found various software including endpoint management and security software where this is exploitable :)
If you want to find vulnerable software, go onto GitHub or public sandboxes etc and look for software that has a service and (un)installs NSIS packages. Triggering an uninstall may be possible through RPC/COM methods or perhaps custom IPC. Iām sure you will find some š
Some example code to get started with a poc:
https://gist.github.com/rxwx/1717e95e5ec11bea12d33e93a3832508
Here is the advisory:
The NSIS uninstaller package did not enforce appropriate permissions on the temporary directory used during the uninstall process. Furthermore, it did not ensure that the temporary directory was removed before running executable content from it. This could potentially result in privilege escalation under certain scenarios.
Rich Warren
