Executive brief
WiX Toolset is a set of tools for building Windows installation packages. The toolset insecurely downloads executable resources over unencrypted HTTP connections, allowing attackers with privileged network access to intercept and replace the executable with malicious code, achieving full system compromise during the installation or build process.
Technical details
The vulnerability is a cleartext download vulnerability (CWE-311) where WiX Toolset downloads executable files over HTTP instead of HTTPS. An attacker positioned on the network path (via compromised network, ISP access, or man-in-the-middle capability) can intercept the HTTP response and replace the executable with malicious code. The attack requires privileged network positioning but no authentication or user interaction beyond initiating the download. The package has not been updated since 2015 and no patch is currently available.
Affected products
- WiX wixtoolset 1.0.0 and earlier; last affected version 1.0.0
Timeline
- 2016: disclosed: CVE-2016-10663 assigned
- 2019-02-18: advisory: GHSA-cr8h-x88h-jwj2 published on GitHub Advisory Database
- 2015: other: Package last updated; no patches available since then