CVE-2021-22037
📋 TL;DR
This vulnerability allows attackers to perform path interception attacks on Windows systems by planting a malicious reg.exe binary that gets executed instead of the legitimate Windows registry tool. It affects InstallBuilder users running Windows installers/uninstallers. Attackers could execute arbitrary code with the privileges of the installer process.
💻 Affected Systems
- InstallBuilder
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution with installer privileges, potentially leading to persistence, data theft, or lateral movement.
Likely Case
Local privilege escalation or arbitrary code execution in the context of the installer, allowing attackers to modify system settings or install malware.
If Mitigated
Limited impact with proper path controls and user privilege restrictions, potentially only allowing limited file manipulation.
🎯 Exploit Status
Requires local access to plant malicious binary and ability to trigger installer/uninstaller execution. Social engineering or existing foothold needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 21.6.0
Vendor Advisory: https://blog.installbuilder.com/2021/10/installbuilder-2160-released.html
Restart Required: No
Instructions:
1. Upgrade InstallBuilder to version 21.6.0 or later. 2. Rebuild affected Windows installers/uninstallers using the patched version. 3. Distribute updated installers to end users.
🔧 Temporary Workarounds
Restrict PATH environment variable
windowsLimit PATH to system directories only during installer execution
set PATH=%SystemRoot%\system32;%SystemRoot%
Use absolute path for reg.exe
windowsModify installer scripts to use full path to reg.exe
%SystemRoot%\system32\reg.exe
🧯 If You Can't Patch
- Run installers with minimal user privileges (not as administrator)
- Monitor for unauthorized reg.exe execution from non-system locations
🔍 How to Verify
Check if Vulnerable:
Check InstallBuilder version - if below 21.6.0, vulnerable. Also check if Windows installers use relative paths for reg.exe calls.Check Version:
installbuilder --versionVerify Fix Applied:
Verify InstallBuilder version is 21.6.0+ and inspect installer scripts for absolute paths to reg.exe.📡 Detection & Monitoring
Log Indicators:
- Process execution of reg.exe from non-standard locations
- Registry modifications during installer execution from unusual paths
Network Indicators:
- Unusual outbound connections following installer execution
SIEM Query:
ProcessName="reg.exe" AND NOT ProcessPath="*\\Windows\\System32\\*" AND ParentProcessName contains "install"