CVE-2025-46715

Executive Summary

CVE-2025-46715 is a high-severity vulnerability in Sandboxie, a sandbox-based isolation software for Windows. The flaw resides in the kernel driver component, specifically within the Api_GetSecureParam function. This function fails to validate or sanitize user-supplied pointers before writing data to them. An attacker, even with low integrity (e.g., from a restricted process), can pass a kernel memory pointer to the driver. The driver then writes the contents of a requested registry key to that arbitrary kernel address. This allows for arbitrary kernel memory write, leading to privilege escalation to SYSTEM and complete compromise of the host operating system. The vulnerability affects versions 1.3.0 through 1.15.11. A patch is available in version 1.15.12.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a binary software distribution for Windows. The supply chain risk is limited to the integrity of the Sandboxie installer itself. Users should only download the patched version from the official Sandboxie website or trusted repositories.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) - The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) - The attack does not require special conditions.
• Privileges Required (PR): Low (L) - The attacker needs only low-integrity process access.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the security scope of the vulnerable component.
• Confidentiality (C): High (H) - Complete disclosure of all system memory.
• Integrity (I): High (H) - Complete control over system memory.
• Availability (A): High (H) - Potential for system crash or denial of service.

Threat Level: Critical for any system running an unpatched version of Sandboxie. The low privileges required and the high impact make this a prime target for malware and privilege escalation exploits.

Deep Dive & Mechanics

The vulnerability is a classic Untrusted Pointer Dereference (CWE-822). The Sandboxie kernel driver exposes an IOCTL (Input/Output Control) interface to user-mode processes. One of the supported operations involves the Api_GetSecureParam function.

Normal Operation:

1. A user-mode process (e.g., a sandboxed application) sends an IOCTL to the Sandboxie driver.
2. The IOCTL includes a pointer to a user-mode buffer where the driver should write the result.
3. The driver's Api_GetSecureParam function is supposed to validate that this pointer is safe to write to (i.e., it points to user-mode memory).
4. The driver then calls GetRegValue to read a specific registry key (e.g., from the Sandboxie configuration) and writes the data to the provided pointer.

Vulnerable Code Path: In vulnerable versions, Api_GetSecureParam does not perform any pointer validation. It blindly trusts the pointer provided by the user-mode caller. An attacker can craft an IOCTL request where the output pointer points to a kernel-mode address (e.g., a critical system structure like EPROCESS or a function pointer table).

Exploitation Mechanics:

1. Craft IOCTL: The attacker creates a malicious user-mode application that sends an IOCTL to the Sandboxie driver.
2. Supply Kernel Pointer: The attacker sets the output buffer pointer to a kernel address they want to overwrite. For example, they could target the Token field of a SYSTEM process's EPROCESS structure to steal its security token.
3. Trigger Write: The driver's GetRegValue function reads the contents of a registry key (which the attacker may also control or know the value of) and writes it to the attacker-supplied kernel pointer.
4. Privilege Escalation: By carefully choosing the kernel address and the registry key value, the attacker can overwrite critical kernel data, such as:
   • Token Stealing: Overwrite the token of a current process with the token of a SYSTEM process.
   • Function Pointer Overwrite: Overwrite a function pointer in a kernel callback table to redirect execution to attacker-controlled code.
   • Data Corruption: Modify security descriptors or process privileges.

Vulnerable vs. Patched Code

The core difference is the addition of pointer validation.

Vulnerable Code (Conceptual):

NTSTATUS Api_GetSecureParam(PVOID UserOutputBuffer, ULONG BufferSize) {
    // NO VALIDATION of UserOutputBuffer
    return GetRegValue(UserOutputBuffer, BufferSize);
}

Patched Code (Conceptual):

NTSTATUS Api_GetSecureParam(PVOID UserOutputBuffer, ULONG BufferSize) {
    NTSTATUS status;
    __try {
        // Probe for write access to user-mode memory
        ProbeForWrite(UserOutputBuffer, BufferSize, sizeof(UCHAR));
        status = GetRegValue(UserOutputBuffer, BufferSize);
    } __except(EXCEPTION_EXECUTE_HANDLER) {
        status = GetExceptionCode();
    }
    return status;
}

The patched version uses ProbeForWrite (or a similar kernel API like MmUserProbeAddress) to verify that the provided pointer is within the user-mode address range and that the calling process has write access to it. If the pointer is invalid or points to kernel memory, the probe raises an exception, which is caught, and the function returns an error.

Exploitation & Lab Setup

Red Team

Objective: Escalate privileges from a low-integrity process to SYSTEM.

Prerequisites:

• Windows system with Sandboxie version 1.3.0 to 1.15.11 installed.
• Ability to execute code (e.g., via a sandboxed application or a low-privilege user account).
• Knowledge of the target kernel memory layout (can be obtained via !process 0 0 in WinDbg or by reading EPROCESS offsets).

Exploit Steps (Conceptual):

1. Identify Target: Find the EPROCESS structure for a SYSTEM process (e.g., System PID 4) and the current process.
2. Calculate Token Offset: Determine the offset of the Token field within the EPROCESS structure (e.g., 0x358 for Windows 10 1809).
3. Open Driver Handle: Obtain a handle to the Sandboxie driver device (e.g., \\.\SandboxieDriver).
4. Craft IOCTL Input:
   • Set the output buffer pointer to the address of the current process's Token field.
   • Set the registry key to read to a key that contains the SYSTEM token value (or a value that will be interpreted as a valid token).
5. Send IOCTL: Call DeviceIoControl with the crafted input.
6. Verify: The current process now has the SYSTEM token. Spawn a new command shell (cmd.exe) which will run as SYSTEM.

Important Note: This is a simplified conceptual example. A real exploit would require precise knowledge of kernel structures and may involve multiple steps to avoid detection.

Blue Team

Detection & Prevention:

• Patch Management: Immediately update Sandboxie to version 1.15.12 or later.
• Driver Blocklisting: If patching is not immediately possible, consider using Windows Defender Application Control (WDAC) or AppLocker to block the loading of the Sandboxie driver (SbieDrv.sys).
• Monitor for Suspicious IOCTLs: Use ETW (Event Tracing for Windows) to monitor for unusual IOCTL calls to the Sandboxie driver. Look for patterns where a low-integrity process sends IOCTLs with large or unusual buffer sizes.
• Kernel Memory Protection: Enable Kernel DMA Protection and Virtualization-Based Security (VBS) to make exploitation more difficult.
• Endpoint Detection and Response (EDR): Deploy EDR solutions that can detect privilege escalation attempts, such as abnormal process token manipulation or kernel memory writes.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256):
  • SbieDrv.sys (vulnerable version): [Hash of vulnerable driver]
  • SbieDrv.sys (patched version): [Hash of patched driver]
• Registry Keys:
  • HKLM\SYSTEM\CurrentControlSet\Services\SbieDrv (Sandboxie driver service)
  • HKCU\Software\Sandboxie (user configuration)
• Processes:
  • SandboxieRpcSs.exe
  • SandboxieDcomLaunch.exe
• Network Indicators:
  • No specific network indicators, as this is a local privilege escalation.
• Behavioral IOCs:
  • A low-integrity process (e.g., chrome.exe or notepad.exe) making DeviceIoControl calls to \\.\SbieDrv.
  • Unusual kernel memory access patterns detected by a kernel-level monitor.
  • Process token manipulation (e.g., a process suddenly gaining SYSTEM privileges).

Detection Engineering

YARA Rule

rule CVE_2025_46715_Sandboxie_Driver {
    meta:
        description = "Detects vulnerable Sandboxie driver SbieDrv.sys"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "SHA256 of vulnerable driver"
    strings:
        $s1 = "Api_GetSecureParam" ascii wide nocase
        $s2 = "GetRegValue" ascii wide nocase
        $s3 = "SbieDrv" ascii wide nocase
    condition:
        all of them and pe.imports("ntoskrnl.exe", "ProbeForWrite") == false
}

Sigma Rule

title: Suspicious IOCTL to Sandboxie Driver
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-46715 via unusual IOCTL calls from low-integrity processes.
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
    category: process_access
detection:
    selection:
        TargetObject: '\\.\SbieDrv'
        GrantedAccess: '0x0012019f'  # Typical IOCTL access
        SourceImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\notepad.exe'
            - '\cmd.exe'
    condition: selection
falsepositives:
    - Legitimate Sandboxie operations from sandboxed processes.
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-46715 Sandboxie Driver Exploitation Attempt"; content:"|5c 00 2e 00 5c 00 53 00 62 00 69 00 65 00 44 00 72 00 76 00|"; fast_pattern; sid:1000001; rev:1;)

Note: This Suricata rule looks for the string \\.\SbieDrv in network traffic, which is unlikely for a local exploit. A more effective detection would be at the host level using Sysmon or ETW.

Remediation & Mitigation

Immediate Action:

1. Patch: Upgrade Sandboxie to version 1.15.12 or later. This is the only complete fix.
2. Workaround: If patching is not possible, uninstall Sandboxie or disable the Sandboxie driver service (SbieDrv). This will break Sandboxie functionality but will remove the vulnerability.

Long-Term Mitigation:

• Least Privilege: Run Sandboxie and sandboxed applications with the least privileges necessary.
• Driver Signing: Ensure only signed, trusted drivers are loaded. Use WDAC to enforce this.
• Regular Updates: Keep all software, especially security-critical drivers, up to date.
• Vulnerability Scanning: Regularly scan for known vulnerabilities using tools like Nessus or OpenVAS.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions or further analysis, contact intelligence@valters-it.com.