CVE-2025-3771

Executive Summary

CVE-2025-3771 is a path or symbolic link manipulation vulnerability in Trellix SIR (System Integrity Recovery) version 1.0.3 and prior. An authenticated non-admin local user can exploit this flaw to overwrite system files with SIR backup files, potentially causing a system crash. The attack vector involves adding a malicious registry entry under the Trellix SIR registry folder, or via policy, or by using a junction symbolic link to target files the user would not normally have permission to access. This vulnerability has a CVSS score of 0.0 (unscored) and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a local privilege escalation vulnerability in a Trellix product.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that no official CVSS vector has been assigned. However, based on the description, the vulnerability requires local access and authentication, but can lead to system file overwrite and potential denial of service. The threat level is considered Medium due to the requirement for local authenticated access.

Deep Dive & Mechanics

The vulnerability resides in the Trellix SIR (System Integrity Recovery) component. SIR is designed to back up and restore system files. The flaw allows an authenticated non-admin user to manipulate the backup/restore process by:

1. Registry Manipulation: Adding a malicious entry to the Windows registry under the Trellix SIR registry folder.
2. Policy Manipulation: Modifying policy settings that control SIR behavior.
3. Junction/Symbolic Link Attack: Creating a junction or symbolic link that points to a system file the user would not normally have permission to access.

When SIR performs a backup or restore operation, it follows the manipulated path or registry entry, causing it to overwrite the target system file with a backup file. This can lead to system instability or a crash.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in SIR versions 1.0.3 and prior. The vulnerability is in the path resolution logic that does not properly validate symbolic links or registry entries.

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable path resolution
char* backup_path = get_registry_value("HKLM\\Software\\Trellix\\SIR\\BackupPath");
// No validation of backup_path
if (create_symbolic_link(backup_path, "C:\\Windows\\System32\\config\\SAM")) {
    // SIR will overwrite the target
    sir_restore(backup_path);
}

Patched Code (Hypothetical):

// Pseudocode for patched path resolution
char* backup_path = get_registry_value("HKLM\\Software\\Trellix\\SIR\\BackupPath");
if (!is_valid_path(backup_path) || is_symlink(backup_path)) {
    log_error("Invalid backup path");
    return;
}
// Additional checks
if (!is_admin() && is_system_file(backup_path)) {
    log_error("Non-admin cannot restore system files");
    return;
}
sir_restore(backup_path);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows machine with Trellix SIR 1.0.3 installed.
• A non-admin user account.

Exploitation Steps:

1. Registry Manipulation:

   # Add a malicious registry entry
   New-Item -Path "HKLM:\Software\Trellix\SIR" -Force
   Set-ItemProperty -Path "HKLM:\Software\Trellix\SIR" -Name "BackupPath" -Value "C:\Windows\System32\config\SAM"
   

2. Junction/Symbolic Link Attack:

   # Create a junction point
   mklink /J C:\Users\Public\Backup C:\Windows\System32\config
   

3. Trigger SIR Backup/Restore:

   • Wait for the scheduled SIR backup or manually trigger it via the Trellix console.

Expected Outcome: The system file (e.g., SAM) is overwritten with a backup file, causing system instability or a crash.

Blue Team

Detection:

• Monitor for unauthorized registry changes under HKLM\Software\Trellix\SIR.
• Monitor for creation of junction points or symbolic links by non-admin users.
• Monitor SIR logs for unusual backup/restore operations.

Hunting:

• Look for processes creating symbolic links to system directories.
• Check for registry entries pointing to system files.

Indicators of Compromise (IOCs)

• Registry Key: HKLM\Software\Trellix\SIR\BackupPath with a value pointing to a system file.
• File System: Junction or symbolic link at C:\Users\Public\Backup pointing to C:\Windows\System32\config.
• Event Logs: Windows Security Event ID 4656 (A handle to an object was requested) for system files by non-admin users.
• SIR Logs: Entries indicating backup/restore of system files by non-admin users.

Detection Engineering

YARA Rule

rule Detect_Trellix_SIR_Exploit {
    meta:
        description = "Detects registry manipulation for CVE-2025-3771"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $reg_key = "Software\\Trellix\\SIR" nocase
        $backup_path = "BackupPath" nocase
    condition:
        $reg_key and $backup_path
}

Sigma Rule

title: Trellix SIR Registry Manipulation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized registry changes to Trellix SIR BackupPath
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 13
        TargetObject|contains: 'Software\Trellix\SIR\BackupPath'
    condition: selection
falsepositives:
    - Legitimate Trellix updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Trellix SIR Exploit - Registry Manipulation"; content:"Software\\Trellix\\SIR\\BackupPath"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict local user permissions to prevent registry modifications under HKLM\Software\Trellix\SIR.
   • Disable junction/symbolic link creation for non-admin users via Group Policy.
   • Monitor and audit SIR backup/restore operations.

2. Long-term Fix:

   • Apply vendor patch when available.
   • Implement input validation for backup paths in SIR.
   • Use integrity checks for registry keys.

3. Workarounds:

   • Remove non-admin users from the local "Users" group if not needed.
   • Use AppLocker or WDAC to block unauthorized registry modifications.

Valters IT
DevSecOps & Cyber Threat Intelligence