CVE-2025-32780

Executive Summary

CVE-2025-32780 is a DLL Hijacking vulnerability affecting BleachBit for Windows up to version 4.6.2. By placing a malicious DLL named uuid.dll in the user-writable directory C:/Users/<username>/AppData/Local/Microsoft/WindowsApps/, an attacker can achieve arbitrary code execution with the privileges of the user running BleachBit. The vulnerability has been patched in version 4.9.0. The CVSS score is 7.3 (High), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. This is a classic Windows DLL sideloading attack, leveraging the insecure DLL search order.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a standalone Windows application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No privileges needed to place the DLL.
• User Interaction (UI): Required (R) – The victim must run BleachBit.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system modification possible.
• Availability (A): High (H) – Full denial of service possible.

Threat Level: High. While the EPSS score is low, the attack vector is simple and requires only user interaction (running the application). The impact is complete compromise of the user's session.

Deep Dive & Mechanics

The vulnerability lies in how BleachBit loads the uuid.dll library. On Windows, when an application loads a DLL without specifying a full path, the system searches a predefined order of directories. One of these directories is the user's AppData\Local\Microsoft\WindowsApps folder. If an attacker can place a malicious uuid.dll in that folder, Windows will load it instead of the legitimate system DLL when BleachBit starts.

Attack Flow:

1. Attacker gains write access to the target user's AppData\Local\Microsoft\WindowsApps folder (e.g., via phishing, malware, or physical access).
2. Attacker places a malicious uuid.dll in that folder.
3. Victim runs BleachBit.
4. Windows loads the malicious uuid.dll from the user's folder.
5. The malicious DLL executes arbitrary code in the context of the user.

Root Cause: BleachBit does not use a secure DLL loading method (e.g., using absolute paths or calling SetDllDirectory to remove unsafe paths from the search order).

Vulnerable vs. Patched Code

Vulnerable Code (BleachBit <= 4.6.2): The application likely uses a standard LoadLibrary or implicit linking to uuid.dll without specifying a full path. This allows the DLL search order to be exploited.

// Vulnerable: Implicit linking or LoadLibrary without full path
HMODULE hMod = LoadLibrary(TEXT("uuid.dll"));

Patched Code (BleachBit >= 4.9.0): The patched version likely uses one of the following approaches:

• Loads uuid.dll from a safe system directory using an absolute path.
• Calls SetDllDirectory("") to remove the current directory from the search order.
• Uses LoadLibraryEx with the LOAD_LIBRARY_SEARCH_SYSTEM32 flag.

// Patched: Use absolute path or safe search flags
HMODULE hMod = LoadLibraryEx(TEXT("C:\\Windows\\System32\\uuid.dll"), NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Windows 10/11 VM with BleachBit 4.6.2 installed.
• Attacker machine with ability to write to the target user's AppData\Local\Microsoft\WindowsApps folder.

Exploit Steps:

1. Create a malicious uuid.dll that executes a payload (e.g., reverse shell, keylogger).
2. Place the DLL in C:\Users\<victim>\AppData\Local\Microsoft\WindowsApps\uuid.dll.
3. Wait for the victim to run BleachBit.
4. The DLL executes, granting code execution.

Example DLL Code (C++):

// malicious_uuid.cpp
#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Execute payload (e.g., reverse shell)
        system("powershell -NoP -NonI -W Hidden -Exec Bypass -Command \"...\"");
    }
    return TRUE;
}

Compile:

x86_64-w64-mingw32-gcc -shared -o uuid.dll malicious_uuid.cpp

Blue Team (Defender)

Detection Steps:

• Monitor for file writes to C:\Users\*\AppData\Local\Microsoft\WindowsApps\uuid.dll.
• Monitor for unusual DLL loads from user-writable paths.
• Use Sysmon to log DLL load events (Event ID 7) and look for uuid.dll loaded from non-system paths.

Hunting Query (KQL):

DeviceEvents
| where ActionType == "DllLoaded"
| where FileName == "uuid.dll"
| where FolderPath startswith "C:\\Users\\"

Indicators of Compromise (IOCs)

• File: C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\uuid.dll (malicious)
• Registry: N/A (no registry persistence required)
• Network: Outbound connections from BleachBit process (if payload is a reverse shell)
• Process: BleachBit.exe loading uuid.dll from a user-writable path
• Hash: SHA256 of malicious uuid.dll (varies per attacker)

Detection Engineering

YARA Rule

rule CVE_2025_32780_DLL_Hijack {
    meta:
        description = "Detects malicious uuid.dll used in CVE-2025-32780"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32780"
    strings:
        $s1 = "uuid.dll" nocase
        $s2 = "AppData\\Local\\Microsoft\\WindowsApps" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: CVE-2025-32780 - BleachBit DLL Hijacking via uuid.dll
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects loading of uuid.dll from user-writable path
author: Valters IT
date: 2025-04-01
logsource:
    product: windows
    category: image_load
detection:
    selection:
        ImageLoaded|endswith: '\\uuid.dll'
        ImageLoaded|startswith: 'C:\\Users\\'
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2025-32780 - Potential BleachBit DLL Hijack Payload"; flow:to_server,established; content:"uuid.dll"; nocase; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade BleachBit to version 4.9.0 or later.
2. Restrict write access to C:\Users\*\AppData\Local\Microsoft\WindowsApps\ for non-admin users.
3. Monitor for unauthorized DLL files in user-writable paths.

Long-term Mitigations:

• Implement application whitelisting (e.g., AppLocker) to block untrusted DLLs.
• Use Windows Defender Application Control (WDAC) to enforce code integrity.
• Educate users about phishing and social engineering attacks that could lead to DLL placement.

Patch Details:

• The vendor has released version 4.9.0 which fixes this issue. Users should update immediately.

Valters IT