CVE-2025-42706

Executive Summary

CVE-2025-42706 is a high-severity vulnerability in the CrowdStrike Falcon sensor for Windows that allows an attacker with prior code execution on a host to delete arbitrary files. The vulnerability stems from a logic error in the sensor's file system interaction, enabling a low-privileged process to exploit the sensor's elevated privileges to delete files outside its intended scope. CrowdStrike has released a fix in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors. The Falcon sensor for Mac, Linux, and Legacy Systems are not impacted. The vulnerability was responsibly disclosed via CrowdStrike's HackerOne bug bounty program by Cong Cheng. There is no evidence of exploitation in the wild, and the EPSS score is 0.0%.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows kernel-mode sensor component.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have prior ability to execute code on the host.
• Attack Complexity: Low (AC:L) – No special conditions required beyond code execution.
• Privileges Required: High (PR:H) – The attacker needs high privileges to exploit the logic error.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not cross security boundaries.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: High (I:H) – Arbitrary file deletion can corrupt system integrity.
• Availability Impact: High (A:H) – Deleting critical system files can cause denial of service.

Threat Level: Medium. The vulnerability requires prior code execution, but once achieved, it can cause significant damage by deleting arbitrary files.

Deep Dive & Mechanics

The vulnerability is a logic error in the Falcon sensor for Windows that handles file system operations. The sensor runs with elevated privileges (SYSTEM) to monitor and protect the host. A logic error in the file deletion routine allows a process with high privileges to bypass the sensor's intended file path validation, enabling deletion of files outside the sensor's allowed scope.

Root Cause: The sensor's file deletion function does not properly validate the target file path against a whitelist of allowed paths. An attacker with code execution can craft a request that exploits this logic error to delete arbitrary files, including critical system files (e.g., C:\Windows\System32\config\SAM, C:\Windows\System32\drivers\etc\hosts).

Attack Vector: The attacker must first gain code execution on the host (e.g., via malware, phishing, or another vulnerability). Once code execution is achieved, the attacker can invoke the Falcon sensor's file deletion API with a crafted path that bypasses validation.

Impact: Successful exploitation can lead to:

• Denial of service by deleting critical system files.
• System instability or crash.
• Potential privilege escalation if the deletion of certain files (e.g., security logs) aids further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7.24): The vulnerable code likely contains a logic error in the file path validation function. For example:

// Vulnerable: Only checks if path starts with allowed prefix
bool IsPathAllowed(const wchar_t* path) {
    if (wcsncmp(path, L"C:\\ProgramData\\CrowdStrike\\", 28) == 0) {
        return true;
    }
    return false;
}

This logic can be bypassed using path traversal (e.g., C:\ProgramData\CrowdStrike\..\..\Windows\System32\config\SAM).

Patched Code (7.24+): The patched code uses canonical path resolution to prevent traversal:

// Patched: Resolves to canonical path before validation
bool IsPathAllowed(const wchar_t* path) {
    wchar_t canonical[MAX_PATH];
    GetFullPathNameW(path, MAX_PATH, canonical, NULL);
    if (wcsncmp(canonical, L"C:\\ProgramData\\CrowdStrike\\", 28) == 0) {
        return true;
    }
    return false;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows host with CrowdStrike Falcon sensor version < 7.24.
• Ability to execute code as a high-privilege user (e.g., Administrator or SYSTEM).

Exploitation Steps:

1. Gain code execution on the target host (e.g., via phishing or lateral movement).
2. Identify the Falcon sensor's file deletion API (e.g., via reverse engineering or known IPC mechanism).
3. Craft a request to delete a critical file using path traversal:

   // Example: Delete SAM hive
   const wchar_t* target = L"C:\\ProgramData\\CrowdStrike\\..\\..\\Windows\\System32\\config\\SAM";
   // Invoke Falcon sensor's file deletion function with target
   

4. Execute the exploit. The sensor will delete the file due to the logic error.

Expected Outcome: The target file is deleted, causing system instability or denial of service.

Blue Team

Detection:

• Monitor for unusual file deletion events by the Falcon sensor process (e.g., CSFalconService.exe).
• Look for file paths containing .. or other traversal patterns in sensor logs.
• Use Sysmon Event ID 23 (File Delete) to track deletions by the sensor.

Hunting:

• Query for file deletion events where the process name is CSFalconService.exe and the target path is outside C:\ProgramData\CrowdStrike\.
• Check for unusual process creation or code execution events prior to the deletion.

Mitigation:

• Apply the patch by upgrading to Falcon sensor version 7.24 or later.
• Restrict high-privilege access to the host.
• Enable file integrity monitoring (FIM) on critical system files.

Indicators of Compromise (IOCs)

• File Paths: C:\ProgramData\CrowdStrike\..\..\Windows\System32\config\SAM, C:\ProgramData\CrowdStrike\..\..\Windows\System32\drivers\etc\hosts
• Process Name: CSFalconService.exe
• Event IDs: Sysmon Event ID 23 (File Delete) with unusual paths
• Registry Keys: N/A
• Network Indicators: N/A (local vulnerability)

Detection Engineering

YARA Rule

rule CVE_2025_42706_Falcon_File_Delete {
    meta:
        description = "Detects attempts to exploit CVE-2025-42706 via path traversal in CrowdStrike Falcon sensor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-42706"
    strings:
        $s1 = "C:\\ProgramData\\CrowdStrike\\..\\..\\" ascii wide nocase
        $s2 = "CSFalconService.exe" ascii wide nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: CVE-2025-42706 - Falcon Sensor Arbitrary File Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file deletion events by CrowdStrike Falcon sensor with path traversal patterns
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-42706
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 23
        Image|endswith: '\CSFalconService.exe'
        TargetFilename|contains: '..'
    condition: selection
falsepositives:
    - Legitimate sensor operations (rare)
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-42706 - Falcon Sensor File Deletion Attempt"; content:"C:\\ProgramData\\CrowdStrike\\..\\..\\"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade CrowdStrike Falcon sensor for Windows to version 7.24 or later.
2. For Long Term Visibility (LTV) sensors, ensure they are on the latest build.
3. Verify that no unauthorized file deletions have occurred by reviewing system logs.

Long-Term Measures:

• Implement the principle of least privilege for all users and processes.
• Enable file integrity monitoring (FIM) on critical system files.
• Regularly review and update endpoint detection and response (EDR) configurations.
• Conduct periodic security assessments and penetration testing.

Workarounds:

• If immediate patching is not possible, restrict high-privilege access to the host and monitor for suspicious file deletion events.

Valters IT