# HCSEC-2023-31 - Vagrant’s Windows Installer Allowed Directory Junction Write

**URL:** <https://discuss.hashicorp.com/t/hcsec-2023-31-vagrant-s-windows-installer-allowed-directory-junction-write/59568>\
**Category:** Security\
**Tags:** security-vagrant\
**Created:** [October 27, 2023, 9:04pm UTC](https://discuss.hashicorp.com/t/hcsec-2023-31-vagrant-s-windows-installer-allowed-directory-junction-write/59568 "2023-10-27T21:04:55Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jfinnigan](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jfinnigan/32/3834_2.png) [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Post date:** [October 27, 2023, 9:04pm UTC](https://discuss.hashicorp.com/t/hcsec-2023-31-vagrant-s-windows-installer-allowed-directory-junction-write/59568/1 "2023-10-27T21:04:55Z")

</div>

**Bulletin ID:** HCSEC-2023-31  
**Affected Products / Versions:** Vagrant’s Windows installer; fixed in Vagrant 2.4.0.  
**Publication Date:** October 27, 2023

**Summary**  
The Vagrant Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. This vulnerability, CVE-2023-5834, was fixed in Vagrant 2.4.0.

**Background**  
Vagrant is distributed in a range of platform-specific formats, available from [Vagrant downloads](https://developer.hashicorp.com/vagrant/downloads).

For the Windows platform, the format used is [Windows Installer](https://learn.microsoft.com/en-us/windows/win32/msi/windows-installer-portal) (MSI).

**Details**  
It was reported that the Vagrant Windows installer’s usage of a custom location with a non-protected path exposed the target system to unauthorized file system write, via usage of a directory junction. The impact of this is system-dependent, but in some cases may include privilege escalation.

**Remediation**  
This was addressed in Vagrant 2.4.0, by moving the Windows install location to the system-protected Program Files directory.

Customers using the Vagrant Windows installer should consider moving to the 2.4.0 release or newer. Please refer to [Upgrading Vagrant](https://developer.hashicorp.com/vagrant/docs/installation/upgrading) for general guidance and upgrade notes.

**Acknowledgement**  
This issue was identified by the Lockheed Martin Red Team.

_We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._