CVE-2025-3599

Executive Summary

CVE-2025-3599 is an Elevation of Privilege (EoP) vulnerability in the Symantec Endpoint Protection (SEP) Windows Agent, specifically within the ERASER Engine component. A local attacker with low privileges can exploit this flaw to delete protected system resources, effectively bypassing security controls and causing a denial of service or data loss. The vulnerability affects ERASER Engine versions prior to 119.1.7.8. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, given the nature of the vulnerability and the widespread deployment of SEP, it poses a significant risk to enterprise environments.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
• Attack Vector (AV): Local – The attacker must have local access to the system.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – The attacker needs a standard user account.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): None – No data exposure.
• Integrity (I): High – The attacker can delete protected resources.
• Availability (A): High – The attacker can cause denial of service by deleting critical files.

Threat Level: Medium. While the CVSS score is 6.5, the ability to delete protected resources can lead to system instability, data loss, and potential privilege escalation if combined with other vulnerabilities.

Deep Dive & Mechanics

The vulnerability resides in the ERASER Engine, a component of Symantec Endpoint Protection responsible for securely deleting files and directories. The engine runs with elevated privileges (SYSTEM context) to perform its operations. Due to improper input validation or permission checks, a low-privileged attacker can invoke the ERASER Engine to delete files or directories that are normally protected, such as system files, registry hives, or other SEP components.

Root Cause: The ERASER Engine does not properly verify that the caller has the necessary permissions to delete the target resource. It trusts the caller's identity without enforcing proper access control checks.

Attack Scenario:

1. An attacker gains a foothold on a system (e.g., via phishing or a low-privilege exploit).
2. The attacker crafts a request to the ERASER Engine, specifying a protected path (e.g., C:\Windows\System32\config\SAM).
3. The ERASER Engine, running as SYSTEM, deletes the file, causing system instability or data loss.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// ERASER Engine API (vulnerable)
int EraseFile(const wchar_t* path) {
    // No permission check
    HANDLE hFile = CreateFileW(path, DELETE, 0, NULL, OPEN_EXISTING, FILE_FLAG_DELETE_ON_CLOSE, NULL);
    if (hFile != INVALID_HANDLE_VALUE) {
        CloseHandle(hFile);
        return 0;
    }
    return -1;
}

Patched Code (Conceptual):

// ERASER Engine API (patched)
int EraseFile(const wchar_t* path) {
    // Check if caller has permission to delete the file
    if (!CheckAccessRights(path, DELETE)) {
        return -1; // Access denied
    }
    HANDLE hFile = CreateFileW(path, DELETE, 0, NULL, OPEN_EXISTING, FILE_FLAG_DELETE_ON_CLOSE, NULL);
    if (hFile != INVALID_HANDLE_VALUE) {
        CloseHandle(hFile);
        return 0;
    }
    return -1;
}

The patched version introduces a permission check (CheckAccessRights) that verifies the caller's identity and ensures they have the necessary rights to delete the target resource.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system running SEP with ERASER Engine < 119.1.7.8.
• A low-privilege user account.

Exploitation Steps:

1. Identify the ERASER Engine service or API endpoint (e.g., named pipe, COM interface, or RPC).
2. Craft a request to delete a protected file, such as C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.7000.7000\Data\Definitions\VirusDefs\*.vdb (virus definitions).
3. Execute the request. The ERASER Engine will delete the file, causing SEP to lose its virus definitions and potentially crash.

Example (Conceptual PowerShell):

# Assuming the ERASER Engine exposes a named pipe
$pipe = New-Object System.IO.Pipes.NamedPipeClientStream(".", "ERASER_PIPE")
$pipe.Connect()
$writer = New-Object System.IO.StreamWriter($pipe)
$writer.WriteLine("DELETE C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.7000.7000\Data\Definitions\VirusDefs\main.vdb")
$writer.Flush()
$pipe.Close()

Blue Team

Detection:

• Monitor for unusual calls to the ERASER Engine API or named pipe.
• Look for attempts to delete files in protected directories (e.g., C:\Windows\System32, C:\ProgramData\Symantec).
• Use Sysmon to log process creation and file deletion events.

Mitigation:

• Apply the patch by upgrading to SEP version 119.1.7.8 or later.
• Restrict local user permissions to prevent exploitation.
• Enable Windows Defender Application Control (WDAC) to block unauthorized executables.

Indicators of Compromise (IOCs)

• File Paths: C:\ProgramData\Symantec\Symantec Endpoint Protection\*\Data\Definitions\VirusDefs\*.vdb (deleted)
• Named Pipe: \\.\pipe\ERASER_PIPE (if exposed)
• Event ID: 4663 (File deletion) with AccessMask = 0x10000 (DELETE)
• Process: eraser_engine.exe (or similar) performing deletions on protected paths
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\Symantec Eraser Engine (service configuration)

Detection Engineering

YARA Rule

rule CVE_2025_3599_ERASER_Engine_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-3599 by calling ERASER Engine to delete protected files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-3599"
    strings:
        $s1 = "ERASER_PIPE" ascii wide nocase
        $s2 = "DELETE" ascii wide nocase
        $s3 = "eraser_engine.exe" ascii wide nocase
    condition:
        any of ($s1, $s2) and $s3
}

Sigma Rule

title: CVE-2025-3599 ERASER Engine File Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file deletion events by the ERASER Engine on protected paths
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|contains:
            - 'C:\Windows\System32'
            - 'C:\ProgramData\Symantec'
        ProcessName|endswith: '\eraser_engine.exe'
    condition: selection
falsepositives:
    - Legitimate SEP operations (e.g., cleaning temporary files)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-3599 ERASER Engine Exploit Attempt"; flow:to_server; content:"ERASER_PIPE"; nocase; content:"DELETE"; nocase; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Symantec Endpoint Protection Windows Agent to version 119.1.7.8 or later.
2. Workaround: If patching is not possible, restrict local user permissions and disable the ERASER Engine service if not required.
3. Monitor: Enable logging for file deletion events (Event ID 4663) and monitor for suspicious activity.

Long-Term Measures:

• Implement the principle of least privilege (PoLP) for all user accounts.
• Use application whitelisting (e.g., WDAC) to prevent unauthorized executables.
• Regularly review and update security policies.

Valters IT Signature:

Report generated by Valters IT DevSecOps & CTI Division