Microsoft Windows Modules Installer Service Information Disclosure
Posted by deepcore on February 18, 2020 – 6:28 am
The TrustedInstaller service running on the Microsoft Windows operating system hosts a COM service called Sxs Store Class; its ISxsStore interface provides methods to install/uninstall assembles via application manifests files into the WinSxS store. These API methods were meant to be available for users with administrative privileges only, but the logic was unintentionally exposed to anyone on the system due to improper implementation of the authorization logic.
Post a reply
You must be logged in to post a comment.