Attack Chain

1. A developer uses Briefcase (versions 0.3.0 - 0.3.25) to create a Windows MSI installer for a Python project intended to be installed for "All Users" (per-machine).
2. The MSI installer is executed, creating a directory (e.g., within C:\Program Files\) for the application binaries. Due to the vulnerable WXS template, this directory inherits insecure permissions from its parent directory.
3. A low-privilege, authenticated user identifies the insecurely permissioned directory created by the MSI installer.
4. The attacker replaces a legitimate application binary (e.g., app.exe) within the directory with a malicious executable.
5. An administrator or privileged user executes the compromised application binary (app.exe) directly or indirectly (e.g., via a scheduled task or shortcut).
6. The malicious executable runs with the elevated privileges of the user who executed it.
7. The attacker performs malicious actions with elevated privileges, such as installing malware, creating new accounts, or modifying system configurations.
8. The attacker achieves persistent access and control over the compromised system.

Impact

Successful exploitation of this vulnerability allows a low-privilege user to gain elevated privileges on a Windows system. The insecure directory permissions created during installation allow malicious users to replace legitimate application binaries with malicious ones. This can lead to complete system compromise, data theft, or denial of service. The vulnerability affects any application built with vulnerable versions of Briefcase and installed for all users on a Windows system. If the compromised application is critical to business operations, the impact could be significant.

Recommendation

• Upgrade Briefcase to version 0.3.26, 0.4.0, or 0.4.1, or later and rebuild the affected Windows MSI installers. This will ensure that the updated WXS templates are used, correcting the insecure directory permissions (beeware/briefcase-windows-app-template#86, beeware/briefcase-windows-VisualStudio-template#85).
• For existing Briefcase projects, apply the change from beeware/briefcase-windows-app-template#86 to the .wxs file.
• Monitor process creation events for execution of binaries from within C:\Program Files\ or C:\Program Files (x86)\ that do not match expected application signatures or have been recently modified, using the provided Sigma rule.
• Review existing installations of applications built with Briefcase versions 0.3.0 - 0.3.25 for insecure directory permissions and remediate by reinstalling the application with an updated installer or manually correcting the permissions.