CVE-2025-14575

Executive Summary

CVE-2025-14575 is a local privilege escalation vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) on Unix systems. The flaw allows an attacker to load a rogue CA certificate as a trusted system authority by placing a crafted certificate file in the application's working directory. This is an Uncontrolled Search Path Element (CWE-427) issue, enabling a local attacker to intercept or modify TLS traffic for any Qt application using the OpenSSL backend.

The vulnerability has a CVSS v3.1 base score of 7.8 (High) due to low attack complexity, local access, and high impact on confidentiality, integrity, and availability. No public exploit code or proof-of-concept is currently available, but the attack vector is straightforward for a local attacker with file write access to the target application's working directory.

Supply Chain & Package Security

Qt is a widely used cross-platform framework, and this vulnerability affects the OpenSSL backend in qtbase. The attack relies on the application's working directory being writable by the attacker, which is common in shared environments or when applications are run from user-writable directories. This is not a package supply chain issue but a runtime configuration weakness.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs a standard user account.
• User Interaction: None (UI:N) – no user action needed beyond running the application.
• Scope: Unchanged (S:U) – the vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – TLS traffic can be decrypted.
• Integrity Impact: High (I:H) – attacker can inject malicious data into TLS streams.
• Availability Impact: High (A:H) – denial of service possible by corrupting certificate trust.

Threat Level: High. The vulnerability is easy to exploit locally and can lead to full TLS interception for any Qt application using the OpenSSL backend.

Deep Dive & Mechanics

The vulnerability resides in the OpenSSL TLS backend of Qt Network (qtbase). When a Qt application initializes TLS, it searches for CA certificates to establish trust. The search path includes the application's working directory. If an attacker places a crafted CA certificate file (e.g., ca-certificates.crt or similar) in that directory, Qt will load it as a trusted root CA.

The attack flow:

1. Attacker gains local access to the system (e.g., via SSH, malware, or shared workstation).
2. Attacker identifies a Qt application that uses the OpenSSL TLS backend.
3. Attacker places a rogue CA certificate file in the application's working directory.
4. When the application starts or makes a TLS connection, Qt loads the rogue certificate.
5. The attacker can then perform man-in-the-middle attacks on the application's TLS traffic.

The vulnerability is specific to Unix systems due to the search path behavior. Windows and macOS are not affected because they use different certificate store mechanisms.

Vulnerable vs. Patched Code

Vulnerable Code (Qt OpenSSL backend):

// Simplified example of certificate loading
QList<QSslCertificate> QSslSocketPrivate::systemCaCertificates() {
    QList<QSslCertificate> certs;
    // Load from default system paths
    certs += loadCertificatesFromPath("/etc/ssl/certs");
    // Vulnerable: also loads from working directory
    certs += loadCertificatesFromPath(QDir::currentPath());
    return certs;
}

Patched Code (hypothetical fix):

QList<QSslCertificate> QSslSocketPrivate::systemCaCertificates() {
    QList<QSslCertificate> certs;
    // Only load from trusted system paths
    certs += loadCertificatesFromPath("/etc/ssl/certs");
    // Remove working directory from search path
    // certs += loadCertificatesFromPath(QDir::currentPath());
    return certs;
}

The fix removes the working directory from the CA certificate search path, ensuring only system-trusted certificates are loaded.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local access to a Unix system with a Qt application using OpenSSL TLS backend.
• Write access to the application's working directory.

Steps:

1. Generate a rogue CA certificate:

   openssl req -x509 -newkey rsa:4096 -keyout rogue_key.pem -out rogue_ca.pem -days 365 -nodes -subj "/CN=RogueCA"
   

2. Place the certificate in the target application's working directory:

   cp rogue_ca.pem /path/to/app/working/dir/ca-certificates.crt
   

3. Run the Qt application. It will now trust the rogue CA.
4. Perform MITM attack using the rogue CA to intercept TLS traffic.

Example MITM with socat:

socat TCP-LISTEN:443,reuseaddr,fork EXEC:./target_app,pty,stderr

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected CA certificate files in application working directories.
• Use file integrity monitoring (FIM) to detect new .crt or .pem files in unusual locations.
• Audit TLS connections for certificates signed by unknown CAs.

Defense:

• Set the QT_SSL_USE_SYSTEM_CA environment variable to 1 to force Qt to use only system CA store.
• Run Qt applications from directories where users cannot write.
• Apply the principle of least privilege to application working directories.

Indicators of Compromise (IOCs)

• File: ca-certificates.crt or *.pem in application working directories that are not part of the system CA store.
• Process: Qt application loading certificates from non-standard paths (monitor with strace or dtrace).
• Network: TLS connections using certificates signed by unknown or self-signed CAs.
• Registry/Config: Presence of QT_SSL_USE_SYSTEM_CA environment variable set to 0 or unset.

Detection Engineering

YARA Rule

rule CVE_2025_14575_Qt_CA_Certificate {
    meta:
        description = "Detects rogue CA certificate files placed in Qt application working directories"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-14575"
    strings:
        $cert_header = "-----BEGIN CERTIFICATE-----"
        $ca_indicator = "CA:TRUE" nocase
        $qt_path = "ca-certificates.crt" nocase
    condition:
        $cert_header and $ca_indicator and $qt_path
}

Sigma Rule

title: Detection of Rogue CA Certificate in Qt Application Working Directory
id: 8f9e2c1a-3b4d-5e6f-7a8b-9c0d1e2f3a4b
status: experimental
description: Detects creation of CA certificate files in non-standard directories
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith:
            - 'ca-certificates.crt'
            - '.pem'
            - '.crt'
        TargetFilename|contains:
            - '/home/'
            - '/tmp/'
            - '/var/tmp/'
    condition: selection
falsepositives:
    - Legitimate applications placing certificates in user directories
level: high

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2025-14575 - Potential MITM via Rogue CA Certificate"; flow:to_server; tls.cert_subject; content:"CN=RogueCA"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Set the environment variable QT_SSL_USE_SYSTEM_CA=1 before running Qt applications.
2. Ensure application working directories are not writable by unprivileged users.
3. Use chmod to restrict write access to directories where Qt applications run.

Long-term Fix:

• Apply the vendor patch when available (expected in a future Qt release).
• Upgrade to a patched version of qtbase (check Qt's official repository for updates).
• Consider using the Secure Transport backend on macOS or Schannel on Windows as alternatives.

Workaround:

• Modify the Qt application's startup script to change the working directory to a secure location:

  cd /secure/path && ./qt_app
  

Valters IT