CVE-2022-27438

Vulnerability

Caphyon Ltd Advanced Installer versions 19.3 and earlier, as well as many products using the Advanced Updater, are affected by a remote code execution vulnerability. The flaw resides in the update check function, specifically in the handling of the CustomDetection parameter. An attacker can craft a malicious update response that causes the updater to execute an arbitrary executable file present on the target machine. The vulnerability is reachable when a user starts an affected installation that triggers the update check.

Exploitation

To exploit this vulnerability, an attacker must first place a malicious executable file on the target machine through a separate, unrelated attack (e.g., social engineering or another vulnerability). Then, the attacker must trick the user into starting an affected installation that performs an update check. The attacker controls the update server or performs a man-in-the-middle attack to serve a crafted response containing a malicious CustomDetection parameter. The updater will then execute the attacker-controlled executable. The reference notes that the chances of synchronizing both attacks are practically zero, and no known exploitation has been reported [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the victim's machine with the privileges of the user running the installer. This can lead to full compromise of the system, including data theft, installation of malware, or further lateral movement within a network. However, the vulnerability alone is insufficient for a complete attack; it requires a separate initial compromise to place the malicious executable.

Mitigation

The vulnerability is fixed in Advanced Installer version 19.4, released in spring 2022. Users should upgrade to Advanced Installer 19.4 or later when building setup packages. Additionally, version 19.4 introduces a security improvement: when using the custom EXE detection method, the detection executable must be signed with the same digital certificate used to sign the updater.exe included in the setup package; otherwise, the update check fails. No workaround is available for earlier versions. Users not using the Auto Updater feature are not affected [2].