IDEA-117378 Privilege escalation via JetBrains products by local attacker

build/conf/nsis/idea.nsi

@@ -15,7 +15,7 @@
 Name "${MUI_PRODUCT}"
 SetCompressor lzma
 ; http://nsis.sourceforge.net/Shortcuts_removal_fails_on_Windows_Vista
-;RequestExecutionLevel user
+RequestExecutionLevel user
 
 ;------------------------------------------------------------------------------
 ; include "Modern User Interface"
@@ -35,10 +35,6 @@ ReserveFile "DeleteSettings.ini"
 ReserveFile '${NSISDIR}\Plugins\InstallOptions.dll'
 !insertmacro MUI_RESERVEFILE_LANGDLL
 
-!define MULTIUSER_EXECUTIONLEVEL Highest
-!define MULTIUSER_INSTALLMODE_COMMANDLINE
-!include MultiUser.nsh
-
 !define MUI_ICON "${IMAGES_LOCATION}\${PRODUCT_ICON_FILE}"
 !define MUI_UNICON "${IMAGES_LOCATION}\${PRODUCT_UNINST_ICON_FILE}"
 
@@ -344,19 +340,29 @@ LicenseLangString myLicenseData ${LANG_JAPANESE} "${LICENSE_FILE}.txt"
 !endif
 
 Function .onInit
-  !insertmacro MULTIUSER_INIT
   StrCpy $baseRegKey "HKCU"
-  IfSilent Done
-  UserInfo::GetOriginalAccountType
-  Pop $R2
-  StrCmp $R2 "Admin" 0 UserNotAdmin
-    SetShellVarContext all
-    StrCpy $INSTDIR "$PROGRAMFILES\${MANUFACTURER}\${PRODUCT_WITH_VER}"
-    StrCpy $baseRegKey "HKLM"
-    goto Done
-UserNotAdmin:
+  IfSilent UAC_Done
+UAC_Elevate:
+    !insertmacro UAC_RunElevated
+    StrCmp 1223 $0 UAC_ElevationAborted ; UAC dialog aborted by user? - continue install under user
+    StrCmp 0 $0 0 UAC_Err ; Error?
+    StrCmp 1 $1 0 UAC_Success ;Are we the real deal or just the wrapper?
+    Quit
+UAC_Err:
+    Abort
+UAC_ElevationAborted:
     StrCpy $INSTDIR "$APPDATA\${MANUFACTURER}\${PRODUCT_WITH_VER}"
-Done:
+    goto UAC_Done
+UAC_Success:
+    StrCmp 1 $3 UAC_Admin ;Admin?
+    StrCmp 3 $1 0 UAC_ElevationAborted ;Try again?
+    goto UAC_Elevate
+UAC_Admin:
+    StrCpy $INSTDIR "$PROGRAMFILES\${MANUFACTURER}\${PRODUCT_WITH_VER}"
+    SetShellVarContext all
+    StrCpy $baseRegKey "HKLM"
+UAC_Done:	
+;  !insertmacro MUI_LANGDLL_DISPLAY
 FunctionEnd
 
 Function checkVersion
@@ -743,7 +749,7 @@ skip_properties:
   ${If} $0 == "1"  
     ;ExecCmd::exec 'icacls "$INSTDIR" /grant %username%:F /T >"$INSTDIR"\installation_log.txt 2>"$INSTDIR"\installation_error.txt'
     AccessControl::GrantOnFile \
-      "$INSTDIR" "(S-1-5-32-545)" "GenericRead + GenericExecute + GenericWrite + Delete"
+      "$INSTDIR" "(S-1-5-32-545)" "GenericRead + GenericExecute"
   ${EndIf}
 SectionEnd
 
@@ -776,7 +782,6 @@ FunctionEnd
 ;------------------------------------------------------------------------------
 
 Function un.onInit
-  !insertmacro MULTIUSER_UNINIT
   !insertmacro MUI_UNGETLANGUAGE
   !insertmacro INSTALLOPTIONS_EXTRACT "DeleteSettings.ini"
 FunctionEnd