CVE-2022-27438: 
Homebrew vulnerability analysis and mitigation

CVE-2022-27438 is a remote code execution vulnerability discovered in Caphyon Ltd Advanced Installer 19.3 and earlier, as well as many products that use the Advanced Installer (Advanced Updater). The vulnerability was discovered in early 2022 and was disclosed in June 2022. The vulnerability exists in the CustomDetection parameter within the update check function (Gerr.re, CVE Mitre).

The vulnerability stems from insufficient authentication of the update server in the Advanced Updater component. The updater allows for specifying an alternate update check using the CustomDetection and CustomDetectionParameter in the requested update configuration. When triggered, either automatically after starting the application or manually through the application menu, the updater executes the specified binary with given parameters in the context of the current user. The vulnerability requires a man-in-the-middle position to exploit, and for updaters using TLS, user interaction is required to proceed through the Windows untrusted certificate security alert (Gerr.re).

The vulnerability allows remote attackers to execute arbitrary code on affected installations. The severity varies depending on the implementation: for unauthenticated/HTTP with elevated privileges, it scores 9.6 CVSS (Critical), for unauthenticated/HTTP it scores 8.8, for TLS with elevated privileges it scores 8.8, and for TLS alone it scores 8.0 (Gerr.re).

The vulnerability was fixed in Advanced Installer 19.4. The fix includes preventing users from downloading updates over untrusted/expired HTTPS connections and requiring the detection EXE to be signed using the same digital certificate used to sign the updater.exe included in the setup package. Users are recommended to update to Advanced Installer 19.4 or newer versions (Advanced Installer).

Caphyon Ltd, the vendor of Advanced Installer, acknowledged the severity of the vulnerability and implemented security improvements in version 19.4. They emphasized that while the vulnerability alone is insufficient for an attack, they took the security improvements seriously and advised all users to upgrade their Advanced Installer version (Advanced Installer).