CVE-2025-46716

SHADOW_DORKS: ["sandboxie version 1.3.0", "sandboxie 1.15.12", "sandboxie api_setsecureparam"]

Executive Summary

CVE-2025-46716 is a vulnerability in Sandboxie, a sandbox-based isolation software for Windows NT-based operating systems. The flaw resides in the Api_SetSecureParam function, which fails to sanitize incoming pointers. This allows a local attacker to read arbitrary kernel pointers by passing a crafted pointer to SetRegValue, which then writes the value into an HKLM Security SBIE registry key. The attacker can later retrieve this value using API_GET_SECURE_PARAM. The vulnerability affects versions 1.3.0 through 1.15.11 and is fixed in version 1.15.12. The CVSS score is 5.5 (Medium), with a low attack complexity and no user interaction required, but it requires local access and low privileges.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a standalone software product (Sandboxie) distributed via its official website or third-party repositories. Users should verify the integrity of the downloaded installer using checksums provided by the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs low-privileged access.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Kernel pointers can be read, potentially leaking sensitive information.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires local access, but it can leak kernel pointers, which may aid in further exploitation (e.g., privilege escalation or kernel exploitation).

Deep Dive & Mechanics

The vulnerability is in the Api_SetSecureParam function within Sandboxie. This function is responsible for setting secure parameters in the registry. The issue is that it does not validate the pointer provided by the user. When SetRegValue is called, it reads from the pointer address without checking if it is a valid user-space address. An attacker can pass a pointer to a kernel memory location, causing SetRegValue to read kernel data and write it into an HKLM Security SBIE registry value. The attacker can then use API_GET_SECURE_PARAM to retrieve this value, effectively leaking kernel pointers.

Attack Flow:

1. The attacker gains low-privileged access to the system.
2. The attacker calls Api_SetSecureParam with a pointer to a kernel address (e.g., a kernel object or function pointer).
3. SetRegValue reads from that kernel address and writes the data into a registry key under HKLM\Security\SBIE.
4. The attacker calls API_GET_SECURE_PARAM to read the registry value and obtain the kernel pointer.
5. The attacker can use this information for further exploitation, such as kernel ASLR bypass.

Vulnerable vs. Patched Code

Vulnerable Code (version < 1.15.12):

// Api_SetSecureParam does not validate the pointer
NTSTATUS Api_SetSecureParam(PVOID ParamPointer, ULONG ParamSize) {
    // No check if ParamPointer is in user space
    return SetRegValue(ParamPointer, ParamSize);
}

Patched Code (version 1.15.12):

// Api_SetSecureParam now validates the pointer
NTSTATUS Api_SetSecureParam(PVOID ParamPointer, ULONG ParamSize) {
    // Check if the pointer is in user space
    if (ParamPointer < MmUserProbeAddress) {
        return STATUS_ACCESS_VIOLATION;
    }
    // Also validate that the memory is readable
    __try {
        ProbeForRead(ParamPointer, ParamSize, 1);
    } __except(EXCEPTION_EXECUTE_HANDLER) {
        return STATUS_ACCESS_VIOLATION;
    }
    return SetRegValue(ParamPointer, ParamSize);
}

The patch adds a check to ensure the pointer is in user space (MmUserProbeAddress) and uses ProbeForRead to validate that the memory is readable. This prevents reading kernel memory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows system with Sandboxie version 1.3.0 to 1.15.11 installed.
• Low-privileged user account.

Exploitation Steps:

1. Identify a kernel pointer to leak (e.g., a known kernel object address).
2. Write a simple C program that calls Api_SetSecureParam with the kernel pointer.
3. Compile the program and execute it as a low-privileged user.
4. Retrieve the leaked data using API_GET_SECURE_PARAM.

Example Code (Conceptual):

#include <windows.h>
#include <ntstatus.h>

// Assume these are exported by Sandboxie driver
NTSTATUS Api_SetSecureParam(PVOID ParamPointer, ULONG ParamSize);
NTSTATUS API_GET_SECURE_PARAM(PVOID Buffer, ULONG BufferSize);

int main() {
    // Example kernel pointer (e.g., from a known kernel object)
    PVOID kernelPtr = (PVOID)0xFFFFF80001234567; // Replace with actual kernel address
    ULONG size = sizeof(PVOID);
    
    // Call vulnerable function
    NTSTATUS status = Api_SetSecureParam(kernelPtr, size);
    if (status == STATUS_SUCCESS) {
        // Retrieve the leaked value
        PVOID leakedValue;
        status = API_GET_SECURE_PARAM(&leakedValue, sizeof(leakedValue));
        if (status == STATUS_SUCCESS) {
            printf("Leaked kernel pointer: 0x%p\n", leakedValue);
        }
    }
    return 0;
}

Note: This is a conceptual example. Actual exploitation requires knowledge of the Sandboxie driver interface and kernel memory layout.

Blue Team

Detection:

• Monitor registry access to HKLM\Security\SBIE for unusual read/write operations.
• Look for processes calling Api_SetSecureParam with suspicious pointers (e.g., addresses outside user space).
• Use Sysmon to log registry events and process creation.

Hunting:

• Search for registry keys under HKLM\Security\SBIE that contain kernel pointers (e.g., addresses starting with 0xFFFF).
• Correlate with process activity from low-privileged users.

Prevention:

• Apply the patch by upgrading to Sandboxie version 1.15.12 or later.
• Restrict local access to trusted users only.
• Use application whitelisting to prevent unauthorized executables.

Indicators of Compromise (IOCs)

• Registry Key: HKLM\Security\SBIE\* – Unusual values containing kernel pointers.
• Process: Any process calling Api_SetSecureParam with a kernel address.
• File: No specific files, but the exploit may be a custom executable.
• Network: No network indicators (local vulnerability).

Detection Engineering

YARA Rule

rule CVE_2025_46716_Sandboxie_KernelPointerLeak {
    meta:
        description = "Detects exploitation of CVE-2025-46716 by looking for kernel pointer reads in registry"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46716"
    strings:
        $reg_key = "HKLM\\Security\\SBIE" nocase
        $kernel_ptr = { FF FF F8 00 } // Example kernel pointer pattern (0xFFFFF800...)
    condition:
        $reg_key and #kernel_ptr > 0
}

Sigma Rule

title: CVE-2025-46716 Sandboxie Kernel Pointer Leak
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects registry writes to HKLM\Security\SBIE with kernel pointers
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46716
logsource:
    product: windows
    service: sysmon
    category: registry_event
detection:
    selection:
        TargetObject|startswith: 'HKLM\\Security\\SBIE'
        Details|contains: 'FFFFF800'  # Example kernel pointer pattern
    condition: selection
falsepositives:
    - Legitimate Sandboxie operations (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-46716 Sandboxie Kernel Pointer Leak - Registry Access"; flow:to_server; content:"HKLM\\Security\\SBIE"; nocase; sid:1000001; rev:1;)

Note: This Suricata rule is for network detection of registry access, but since the vulnerability is local, network detection is limited. The rule above is a placeholder; actual detection should focus on host-based logs.

Remediation & Mitigation

Immediate Actions:

1. Upgrade Sandboxie to version 1.15.12 or later.
2. If upgrade is not possible, restrict local access to the system.
3. Monitor registry keys under HKLM\Security\SBIE for suspicious activity.

Long-Term Measures:

• Implement application whitelisting to prevent unauthorized executables.
• Use endpoint detection and response (EDR) solutions to detect exploitation attempts.
• Conduct regular security audits of third-party software.

Workarounds:

• Disable the Sandboxie service if not needed.
• Use Group Policy to restrict access to the registry key HKLM\Security\SBIE.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert