CVE-2025-67794

Executive Summary

CVE-2025-67794 is a local privilege escalation vulnerability in DriveLock agent software, affecting versions 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. The vulnerability arises from overly permissive Access Control Lists (ACLs) on directories and files created by the agent. This misconfiguration allows local users without administrator rights to trigger actions or destabilize the agent, potentially leading to denial of service or unauthorized modifications. The vulnerability has a CVSS score of 0.0 (pending official assessment), but based on the description, it is a medium-severity local issue. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary commercial software product, DriveLock. The supply chain risk is limited to the distribution of the DriveLock agent binary, which should be obtained from official vendor sources.

CVSS Breakdown & Threat Level

The official CVSS score is 0.0, indicating that the NVD has not yet assigned a score. Based on the vulnerability description, a reasonable assessment is:

• Attack Vector (AV): Local (L) – requires local access to the system.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – attacker needs a standard user account.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – vulnerability affects only the agent.
• Confidentiality (C): Low (L) – potential to read agent files.
• Integrity (I): Low (L) – potential to modify agent files.
• Availability (A): High (H) – potential to destabilize the agent, causing denial of service.

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Base Score: 6.1 (Medium)

Threat Level: Medium. Exploitation requires local access and low privileges, but can lead to significant availability impact.

Deep Dive & Mechanics

The DriveLock agent creates directories and files with overly permissive ACLs. This means that standard users (non-administrators) can read, write, or delete these files. The agent likely stores configuration, state, or temporary data in these locations. An attacker with local access can:

• Modify configuration files to alter agent behavior.
• Delete critical files to cause the agent to crash or malfunction.
• Create symbolic links to escalate privileges or interfere with other processes.
• Read sensitive data that the agent stores (e.g., logs, cached credentials).

The root cause is a failure to apply the principle of least privilege when setting file and directory permissions. The agent should restrict access to only the SYSTEM account or the user under which the agent runs.

Vulnerable vs. Patched Code

Since this is a proprietary product, exact code snippets are not available. However, the fix involves changing the ACLs on created directories and files.

Vulnerable (Conceptual):

// Creating a directory with default permissive ACLs
CreateDirectory("C:\\ProgramData\\DriveLock\\AgentData", NULL);
// Default ACL allows Everyone to read/write

Patched (Conceptual):

// Creating a directory with restrictive ACLs
SECURITY_ATTRIBUTES sa;
// Initialize sa with a DACL that only allows SYSTEM and Administrators
CreateDirectory("C:\\ProgramData\\DriveLock\\AgentData", &sa);

The patched code explicitly sets a security descriptor that denies access to standard users.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with a vulnerable DriveLock agent (24.1-24.1.*, 24.2 < 24.2.8, 25.1 < 25.1.6).
• A standard user account (non-administrator).

Steps:

1. Identify the DriveLock agent's data directory (e.g., C:\ProgramData\DriveLock\).
2. Check ACLs on files and subdirectories:

   Get-Acl -Path "C:\ProgramData\DriveLock\AgentData" | Format-List
   

3. If the ACL allows BUILTIN\Users to modify files, create a malicious script or modify an existing configuration file.
4. For example, to cause a denial of service, delete a critical file:

   Remove-Item -Path "C:\ProgramData\DriveLock\AgentData\config.ini" -Force
   

5. To trigger actions, modify a configuration file to change agent behavior (e.g., disable logging, change update server).

Expected Outcome: The agent may crash, fail to start, or behave unexpectedly.

Blue Team

Detection:

• Monitor for unauthorized file modifications in DriveLock directories.
• Use Sysmon to log file creation and modification events (Event ID 11, 2).
• Alert on changes to files in C:\ProgramData\DriveLock\ by non-SYSTEM processes.

Hunting:

• Search for processes accessing DriveLock files with suspicious permissions.
• Look for symbolic link creation in DriveLock directories.

Mitigation:

• Apply the vendor patch (upgrade to 24.2.8 or 25.1.6).
• Restrict local user accounts to only necessary privileges.
• Use AppLocker or WDAC to prevent unauthorized executables.

Indicators of Compromise (IOCs)

• File Paths:
  • C:\ProgramData\DriveLock\AgentData\*
  • C:\ProgramData\DriveLock\config.ini
  • C:\ProgramData\DriveLock\logs\*
• Registry Keys: (if applicable) HKLM\SOFTWARE\DriveLock\Agent
• Process Names: drivelockagent.exe, dlservice.exe
• Event Logs:
  • Windows Security Event ID 4663 (attempted access to an object)
  • Sysmon Event ID 11 (FileCreate)
  • Sysmon Event ID 2 (FileCreateTime)

Detection Engineering

YARA Rule

rule CVE_2025_67794_DriveLock_ACL {
    meta:
        description = "Detects overly permissive ACLs on DriveLock agent files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67794"
    strings:
        $s1 = "C:\\ProgramData\\DriveLock" nocase
        $s2 = "BUILTIN\\Users" nocase
        $s3 = "Everyone" nocase
    condition:
        $s1 and ($s2 or $s3)
}

Sigma Rule

title: DriveLock Agent Overly Permissive ACLs
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of files with overly permissive ACLs in DriveLock directories
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-67794
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|contains: 'C:\ProgramData\DriveLock'
        AccessMask|contains: '0x6'  # WRITE_DAC or WRITE_OWNER
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2025-67794 DriveLock ACL Exploitation Attempt"; flow:to_server,established; content:"DriveLock"; nocase; content:"config.ini"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade DriveLock agent to version 24.2.8 or 25.1.6.
2. If upgrade is not possible, manually restrict ACLs on the DriveLock data directory:

   $path = "C:\ProgramData\DriveLock"
   $acl = Get-Acl $path
   $acl.SetAccessRuleProtection($true, $false)
   $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM","FullControl","ContainerInherit,ObjectInherit","None","Allow")
   $acl.AddAccessRule($rule)
   $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")
   $acl.AddAccessRule($rule)
   Set-Acl $path $acl
   

3. Monitor for unauthorized access attempts.

Long-term:

• Implement least privilege for all service accounts.
• Regularly audit file permissions on critical system directories.
• Use a file integrity monitoring (FIM) solution.

Valters IT
Securing your digital frontier.