CVE-2025-14599

Executive Summary

CVE-2025-14599 is an Uncontrolled Search Path Element vulnerability (CWE-427) affecting Altera Quartus Prime Standard and Lite Installers (SFX) on Windows. This flaw allows an attacker to perform Search Order Hijacking, potentially leading to arbitrary code execution in the context of the installer process. The vulnerability impacts versions 23.1 through 24.1 of both Quartus Prime Standard and Lite. No official patch has been released, and no public proof-of-concept (PoC) or exploit code is currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for organizations using these tools in development or manufacturing environments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a Windows-based installer issue within the Altera Quartus Prime toolchain, which is part of the Intel FPGA ecosystem. The risk is primarily to development and manufacturing supply chains where these tools are deployed.

CVSS Breakdown & Threat Level

The CVSS vector is not provided, but based on the vulnerability type (CWE-427) and attack vector (local, requiring user interaction), a reasonable estimate is:

• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 7.8 (High)

Threat Level: High. While no public exploits exist, the vulnerability allows an attacker to hijack the search path during installation, potentially loading malicious DLLs or executables. This can lead to full system compromise if the installer runs with elevated privileges.

Deep Dive & Mechanics

The vulnerability resides in the Altera Quartus Prime Installer (SFX) for Windows. The installer uses an uncontrolled search path when loading dynamic-link libraries (DLLs) or other executable components. Specifically, the installer may search for files in directories that are writable by unprivileged users (e.g., the current working directory, user's temp folder, or other user-controlled paths) before searching in secure system directories.

An attacker can exploit this by placing a malicious DLL or executable in a location that the installer searches before the intended system path. When the installer runs, it loads the malicious file instead of the legitimate one, leading to arbitrary code execution. This is a classic "DLL Hijacking" or "Search Order Hijacking" attack.

The affected versions are:

• Quartus Prime Standard: 23.1 through 24.1
• Quartus Prime Lite: 23.1 through 24.1

The vulnerability is present in the installer (SFX) component, not the main application itself. This means exploitation occurs during the installation process, not during normal use of the software.

Vulnerable vs. Patched Code

No patch is currently available. The vulnerable code is within the installer's search path logic. A patched version would likely:

• Use absolute paths for all DLL and executable loads.
• Set the SafeDllSearchMode registry key to ensure system directories are searched first.
• Validate the digital signature of loaded binaries before execution.

Since no patch exists, no code diff can be provided.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows system with Altera Quartus Prime Installer (version 23.1-24.1) present.
• Ability to write to a directory that the installer searches (e.g., the user's temp folder or the directory from which the installer is launched).

Exploitation Steps:

1. Identify the vulnerable installer executable (e.g., QuartusSetup.exe).
2. Determine which DLLs the installer loads without a full path. Common targets include version.dll, dbghelp.dll, or wintrust.dll.
3. Create a malicious DLL that exports the same functions as the legitimate DLL but includes a payload (e.g., reverse shell, privilege escalation).
4. Place the malicious DLL in a directory that the installer searches before the system path (e.g., the same directory as the installer, or the user's %TEMP% folder).
5. Execute the installer. The malicious DLL will be loaded, executing the payload.

Example Payload (C, compiled as DLL):

#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Execute calc.exe as a proof of concept
        WinExec("calc.exe", SW_SHOW);
    }
    return TRUE;
}

Compile:

x86_64-w64-mingw32-gcc -shared -o version.dll payload.c

Blue Team

Detection:

• Monitor for unusual DLL load events from user-writable directories during installation.
• Use Sysmon Event ID 7 (DLL loaded) to detect when a DLL is loaded from a non-standard path.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block untrusted DLL loads.

Hunting:

• Search for instances of QuartusSetup.exe or QuartusPrime*.exe loading DLLs from %TEMP%, %APPDATA%, or the current working directory.
• Look for unsigned DLLs loaded by the installer.

Mitigation:

• Run the installer from a trusted, read-only location (e.g., a network share with read-only permissions).
• Use Group Policy to enforce SafeDllSearchMode (set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode to 1).
• Apply the principle of least privilege: do not run the installer as an administrator unless necessary.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but monitor for any DLLs named version.dll, dbghelp.dll, or wintrust.dll placed in user-writable directories during installation.)
• Process Names: QuartusSetup.exe, QuartusPrime*.exe
• Registry Keys: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode (value 0 indicates vulnerable state)
• Network Connections: Outbound connections from the installer to unknown IPs (if payload includes reverse shell).
• File Paths: %TEMP%\*.dll, %APPDATA%\*.dll, C:\Users\*\*.dll loaded by the installer.

Detection Engineering

YARA Rule

rule CVE_2025_14599_Altera_Quartus_Installer_Hijack {
    meta:
        description = "Detects potential DLL hijacking attempts against Altera Quartus Prime Installer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14599"
    strings:
        $s1 = "QuartusSetup.exe" nocase
        $s2 = "QuartusPrime" nocase
        $s3 = "version.dll" nocase
        $s4 = "dbghelp.dll" nocase
        $s5 = "wintrust.dll" nocase
    condition:
        (uint16(0) == 0x5A4D) and // MZ header
        (($s1 or $s2) and ($s3 or $s4 or $s5))
}

Sigma Rule

title: Altera Quartus Prime Installer DLL Hijacking
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects DLL load events from user-writable directories during Altera Quartus Prime installation
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14599
logsource:
    product: windows
    service: sysmon
    definition: 'Sysmon Event ID 7 (DLL loaded) must be enabled'
detection:
    selection:
        EventID: 7
        Image|endswith:
            - '\QuartusSetup.exe'
            - '\QuartusPrime*.exe'
        ImageLoaded|startswith:
            - 'C:\Users\'
            - 'C:\Windows\Temp\'
            - '%TEMP%'
    condition: selection
falsepositives:
    - Legitimate DLLs loaded from user directories (rare)
level: high
tags:
    - attack.t1574
    - cve.2025.14599

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-14599 - Altera Quartus Prime Installer Potential DLL Hijack";
    flow:to_server,established;
    content:"QuartusSetup.exe"; nocase;
    content:"version.dll"; nocase;
    distance:0;
    sid:1000001;
    rev:1;
    reference:cve,2025-14599;
    classtype:attempted-user;
)

Remediation & Mitigation

Immediate Actions:

1. Do not run the installer as Administrator unless absolutely necessary.
2. Run the installer from a trusted, read-only location (e.g., a network share with read-only permissions).
3. Enable SafeDllSearchMode via Group Policy or registry:
   • Set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode to 1 (DWORD).
4. Monitor for suspicious DLL loads using Sysmon or EDR tools.

Long-term Fix:

• Await an official patch from Altera/Intel. Until then, consider using alternative FPGA development tools or sandboxing the installation process.
• Apply the principle of least privilege to all installation processes.

Workaround:

• Extract the installer contents manually using a tool like 7-Zip and run the setup from a secure, controlled directory.

Valters IT