# Windows Installer EOP (CVE-2023-21800)

Windows Installer repair auto-elevates to SYSTEM and follows user-planted junctions/symlinks via poisoned PROGRAMDATA env var, yielding arbitrary file delete as SYSTEM.

- Payout: Research
- Severity: high
- Program: Windows Installer
- Credited: Doyensec
- Disclosed: 2023-03-20
- CVE: CVE-2023-21800
- Write-up quality: 8/10
- Original: https://blog.doyensec.com/2023/03/21/windows-installer.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2023-03-21-windows-installer-html
- Tags: domain:desktop impact:integrity impact:privesc kind:research platform:research sev:high tech:windows technique:recon technique:source-review vuln:path-traversal vuln:privilege-escalation

**Target:** msiexec.exe repair operation (/fa) on signed MSI packages
**Root cause:** The MSI rollback mechanism performs SetRenameInformationFile (move) on files under paths derived from user-controllable environment variables (e.g. PROGRAMDATA) using a non-impersonated SYSTEM token, so a user-planted junction/symlink redirects the privileged move to an arbitrary file.
**Steps:**
1. Identify an installed MSI package GUID via `Get-WmiObject -class Win32_Product` or registry.
2. Poison env var: `setx PROGRAMDATA C:\FakeProgramData`, then start a fresh cmd.exe to inherit it.
3. Create `C:\FakeProgramData\Microsoft\Windows\Start Menu\Programs\7-zip\` and place a junction/symlink named `7-Zip Help.lnk` pointing to target e.g. `C:\Windows\System32\__doyensec.txt`.
4. Run `msiexec.exe /fa '{B460110D-ACBF-34F1-883C-CC985072AF9E}'` (or /fc, /fs) to force repair.
5. Observe in ProcMon: SYSTEM-token SetRenameInformationFile moves the target file (rollback), then impersonated restore fails with ACCESS DENIED, leaving the file deleted.
**How found:** Researcher audited signed MSI packages with ProcMon during repair (/fa), filtering for non-impersonated SYSTEM file operations on user-influenceable paths; noticed env vars set by the unprivileged user were reused in the SYSTEM repair context, traced to the rollback mechanism rather than app-level env trust.
**Exploitation:** Unprivileged user poisons PROGRAMDATA, plants a junction to a privileged target file in the expected installer path, and triggers msiexec repair which auto-elevates to SYSTEM; the rollback move deletes the arbitrary file as SYSTEM while the restore runs impersonated and fails.
**Escalation:** Arbitrary file delete as SYSTEM can be chained to arbitrary folder delete and, per Naceri's technique, to code execution; arbitrary file creation could plant DLLs for hijacking.
**Insight:** During MSI repair, watch for SYSTEM-token file moves (SetRenameInformationFile) on paths built from env vars like PROGRAMDATA/APPDATA; poisoning those vars plus a junction turns the rollback move into a privileged arbitrary file delete.