CVE-2022-36088: Other (NVD-CWE-Other)
value: GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the server GoCD Server or Agent are installed on to modify executables or components of the installation. This does not affect zip file-based installs, installations to other platforms, or installations inside `Program Files` or `Program Files (x86)`. This issue is fixed in GoCD 22.2.0 installers. As a workaround, if the server or agent is installed outside of `Program Files (x86)`, verify the the permission of the Server or Agent installation directory to ensure the `Everyone` user group does not have `Full Control`, `Modify` or `Write` permissions.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.5
Published: 2022-09-07T23:15Z
Repository: https://github.com/gocd/gocd
Language: Other
Files changed: installers/windows/go-base.nsi
Commit date: 2022-05-17 23:24:52 +0800
Commit message: Add NSIS AccessControl plugin to set permissions on install dir

From https://nsis.sourceforge.io/AccessControl_plug-in adding ANSI version (i386) since that's we are using for now.

Diff: diff --git a/installers/windows/go-base.nsi b/installers/windows/go-base.nsi
index 5b456330f55..c0fd0ec3534 100644
--- a/installers/windows/go-base.nsi
+++ b/installers/windows/go-base.nsi
@@ -150,18 +150,35 @@ Function ".onInit"
     ${LogText} "Performing install (not upgrade)"
   ${EndIf}
   ${LogSet} off
 FunctionEnd
 
+Function "SetupDirectoryPermissions"
+    ${LogText} "Setting directory permissions..."
+
+	; Disable inheritance. This breaks the inheritance chain and turns inherited permissions into explicit ones.
+	AccessControl::DisableFileInheritance $INSTDIR
+	; Make Administrators the owner
+	AccessControl::SetFileOwner $INSTDIR "(S-1-5-32-544)"
+	; Clear all explicit permissions on the file, leaving Administrators with full access
+	AccessControl::ClearOnFile  $INSTDIR "(S-1-5-32-544)" "FullAccess"
+	; Give SYSTEM full access.
+	AccessControl::SetOnFile    $INSTDIR "(S-1-5-18)"     "FullAccess"
+	; Give Everyone only access to read, list dir, and execute.
+	AccessControl::SetOnFile    $INSTDIR "(S-1-1-0)"      "GenericRead + GenericExecute + ListDirectory + ReadAttributes"
+FunctionEnd
+
 ; This section (being the first one, not because it's called Install) will be executed after the `.onInit` callback
 Section "Install"
   SectionIn RO
 
   SetOverWrite on
   SetOutPath $INSTDIR
   ${LogSet} on
 
+  Call SetupDirectoryPermissions
+
   ${If} $IsUpgrading == "true"
     ${LogText} "Performing an upgrade"
     Call BeforeUpgrade
     File /r ${GOCD_ICON}
     File /r /x "wrapper-properties.conf" ${INSTALLER_CONTENTS}\*.*
diff --git a/installers/windows/nsis-plugins/AccessControl.dll b/installers/windows/nsis-plugins/AccessControl.dll
new file mode 100644
index 00000000000..c5b3b5400eb
Binary files /dev/null and b/installers/windows/nsis-plugins/AccessControl.dll differ

Fixed code: Function "SetupDirectoryPermissions"
    ${LogText} "Setting directory permissions..."

	; Disable inheritance. This breaks the inheritance chain and turns inherited permissions into explicit ones.
	AccessControl::DisableFileInheritance $INSTDIR
	; Make Administrators the owner
	AccessControl::SetFileOwner $INSTDIR "(S-1-5-32-544)"
	; Clear all explicit permissions on the file, leaving Administrators with full access
	AccessControl::ClearOnFile  $INSTDIR "(S-1-5-32-544)" "FullAccess"
	; Give SYSTEM full access.
	AccessControl::SetOnFile    $INSTDIR "(S-1-5-18)"     "FullAccess"
	; Give Everyone only access to read, list dir, and execute.
	AccessControl::SetOnFile    $INSTDIR "(S-1-1-0)"      "GenericRead + GenericExecute + ListDirectory + ReadAttributes"
FunctionEnd

  Call SetupDirectoryPermissions