CVE-2023-29081

Executive Summary

CVE-2023-29081 is a locally exploitable vulnerability in Suite Setups built with InstallShield versions prior to 2023 R2. The flaw allows a locally authenticated user to cause a Denial of Service (DoS) condition by manipulating move operations on temporary folders. With a CVSS score of 5.5 (Medium), the vulnerability requires local access and low privileges, but no user interaction. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept or exploit code is available. The vendor has released a fix in InstallShield 2023 R2.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is specific to the InstallShield installer builder tool and the Suite Setups it produces.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Base Score: 5.5 (Medium)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs valid local user credentials.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – The system becomes unavailable due to DoS.

Threat Level: Medium. The requirement for local access reduces the attack surface, but the low complexity and lack of user interaction make it a viable vector for insider threats or post-exploitation scenarios.

Deep Dive & Mechanics

The vulnerability resides in the temporary folder handling logic of Suite Setups built with InstallShield. During the installation or uninstallation process, the setup creates temporary folders to store intermediate files. The flaw occurs when a locally authenticated user performs a move operation on these temporary folders.

Root Cause: The setup process does not properly validate the source or destination of move operations on temporary folders. An attacker can exploit this by creating a symbolic link or a junction point that redirects the move operation to a critical system path (e.g., C:\Windows\System32). When the setup attempts to move files, it may overwrite or delete essential system files, leading to a system crash or persistent denial of service.

Attack Flow:

1. The attacker gains local access to the target system (e.g., via compromised credentials or physical access).
2. The attacker identifies a Suite Setup process running with elevated privileges (e.g., during installation).
3. The attacker creates a symbolic link from the temporary folder to a critical system directory.
4. The Suite Setup performs a move operation, following the symbolic link and corrupting system files.
5. The system becomes unstable or crashes, resulting in a DoS condition.

Vulnerable vs. Patched Code

The vulnerable code is in the temporary folder management component of InstallShield. The exact code is proprietary, but the fix involves adding validation checks for move operations.

Vulnerable (Conceptual):

// Vulnerable: No validation of move destination
void MoveTempFiles(const std::string& source, const std::string& dest) {
    // Directly moves files without checking if dest is a system path
    MoveFile(source.c_str(), dest.c_str());
}

Patched (Conceptual):

// Patched: Validate destination path
void MoveTempFiles(const std::string& source, const std::string& dest) {
    // Check if destination is within allowed temporary directories
    if (!IsPathSafe(dest)) {
        LogError("Move operation blocked: unsafe destination");
        return;
    }
    MoveFile(source.c_str(), dest.c_str());
}

The patch ensures that move operations only target safe, temporary directories and do not follow symbolic links to critical system paths.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with a vulnerable Suite Setup installed.
• Ability to create symbolic links (requires SeCreateSymbolicLinkPrivilege, often granted to administrators).

Exploitation Steps:

1. Identify a Suite Setup process (e.g., setup.exe) running with SYSTEM privileges.
2. Create a symbolic link from the temporary folder to a critical system directory:

   mklink /D C:\Temp\VulnFolder C:\Windows\System32
   

3. Trigger the move operation by initiating an installation or uninstallation of the Suite Setup.
4. The setup moves files to C:\Windows\System32, corrupting system files and causing a crash.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for creation of symbolic links to critical system directories (e.g., C:\Windows\System32).
• Alert on unusual file move operations from temporary folders to system paths.
• Use Sysmon Event ID 1 (Process creation) and Event ID 11 (FileCreate) to track suspicious activity.

Mitigation:

• Apply the vendor patch by upgrading to InstallShield 2023 R2 or later.
• Restrict the SeCreateSymbolicLinkPrivilege to only trusted administrators.
• Use AppLocker or Windows Defender Application Control to block unauthorized executables.

Indicators of Compromise (IOCs)

• File System:
  • Symbolic links pointing from C:\Users\<User>\AppData\Local\Temp\* to C:\Windows\System32 or other critical paths.
  • Unexpected file modifications in C:\Windows\System32 during Suite Setup execution.
• Process:
  • setup.exe or SuiteSetup.exe performing move operations to system directories.
• Event Logs:
  • Windows Security Log: Event ID 4670 (Permissions on an object were changed) for symbolic link creation.
  • Sysmon: Event ID 11 (FileCreate) for symbolic link creation.

Detection Engineering

YARA Rule

rule CVE_2023_29081_SymbolicLink_DoS {
    meta:
        description = "Detects symbolic links created to exploit CVE-2023-29081"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-29081"
    strings:
        $s1 = "SymbolicLink" nocase
        $s2 = "\\Windows\\System32" nocase
        $s3 = "\\Temp\\" nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2023-29081 Symbolic Link Creation to System Directory
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of symbolic links from temporary folders to critical system directories, indicating exploitation of CVE-2023-29081.
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename|contains: '\\Windows\\System32'
        TargetFilename|endswith: '.lnk'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-29081 Potential DoS via Symbolic Link"; flow:to_server,established; content:"|5c|Windows|5c|System32"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to InstallShield 2023 R2 or later to apply the vendor patch.
2. If upgrade is not possible, restrict local user permissions to prevent symbolic link creation.
3. Monitor for suspicious file operations using the provided detection rules.

Long-Term Measures:

• Implement the principle of least privilege for all local users.
• Regularly audit temporary folder permissions and symbolic link creation.
• Use endpoint detection and response (EDR) tools to alert on anomalous behavior.

Workaround:

• Disable the Suite Setup service or remove vulnerable Suite Setups until patching is complete.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert