CVE-2025-0712: Privilege Escalation Vulnerability

CVE-2025-0712 Overview

CVE-2025-0712 is an uncontrolled search path element vulnerability [CWE-427] that enables local privilege escalation (LPE) through insecure directory permissions. The flaw stems from improper handling of directory permissions in the affected installer. An attacker with local access can exploit this weakness to move and delete arbitrary files. Successful exploitation may allow the attacker to obtain SYSTEM privileges on the target Windows host. The vulnerability is referenced in an Elastic security advisory covering the Beats Windows installer.

Critical Impact
A local attacker with low privileges can escalate to SYSTEM by abusing writable directories in the installer search path, gaining full control of the affected Windows system.

Affected Products

Elastic Beats Windows Installer (per referenced Elastic advisory ESA-2025-12)
Windows hosts where the vulnerable installer is present
Systems relying on the affected directory permissions configuration

Discovery Timeline

2025-07-30 - CVE-2025-0712 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0712

Vulnerability Analysis

The vulnerability is classified under [CWE-427] Uncontrolled Search Path Element. During execution, the affected installer or its associated service resolves file or library paths using directories whose permissions allow write access to non-privileged users. An authenticated local attacker can place, move, or delete files within these directories to influence the code or resources loaded by a higher-privileged process. Because the affected process runs with elevated rights, hijacking its search path or removing protected files results in code execution or file manipulation as SYSTEM.

Exploitation requires local access and some conditions to be met, but yields high impact across confidentiality, integrity, and availability. The flaw enables an attacker to break the isolation between a standard user context and privileged Windows services.

Root Cause

The root cause is insecure directory permissions applied to a directory that participates in the process search path. Windows installers frequently create working directories or install paths that inherit weak Access Control Lists (ACLs). When a privileged process later reads binaries, DLLs, or resources from these paths without validating trust, an attacker-controlled artifact can be substituted or an existing artifact can be removed. See the Elastic Security Update Discussion for vendor context.

Attack Vector

The attack vector is local. A low-privileged user leverages write access on an insecurely permissioned directory to plant a malicious payload or to move and delete files consumed by a privileged process. When the privileged process next runs, it loads the attacker-controlled resource or fails in a way that grants file operations under SYSTEM. No user interaction is required. The vulnerability is described in prose only; no verified public exploit code is available at this time.

Detection Methods for CVE-2025-0712

Indicators of Compromise

Unexpected files, DLLs, or executables appearing in directories associated with the Elastic Beats installer.
File move or delete operations targeting installer or service directories originating from non-administrative user contexts.
New services, scheduled tasks, or processes running as SYSTEM that spawn from paths writable by standard users.

Detection Strategies

Audit Windows Security event logs for 4663 (object access) and 4670 (permissions changed) events on installer and service directories.
Monitor process creation events (4688 / Sysmon Event ID 1) where a SYSTEM-level process loads modules from user-writable paths.
Enable Sysmon ImageLoad (Event ID 7) events and alert on privileged processes loading DLLs from non-standard directories.

Monitoring Recommendations

Continuously inventory directory ACLs on installed software paths and flag any world-writable or user-writable directories used by privileged services.
Correlate file system changes with subsequent privileged process executions to identify search-path hijack chains.
Track installations and upgrades of Elastic Beats on Windows endpoints and validate that patched versions are deployed.

How to Mitigate CVE-2025-0712

Immediate Actions Required

Upgrade the Elastic Beats Windows installer to the fixed version referenced in the vendor advisory ESA-2025-12.
Inventory Windows hosts running Beats agents and prioritize remediation on multi-user systems where local users could reach the affected directories.
Restrict interactive local logon on servers running the Beats agent to reduce the attacker population.

Patch Information

Elastic released a security update addressing this vulnerability. Review the Elastic Security Update Discussion for the fixed version and upgrade procedure. Apply the vendor-provided installer to correct the directory permissions and eliminate the uncontrolled search path condition.

Workarounds

Manually harden ACLs on the affected installation directories so that only administrators and SYSTEM can write, move, or delete files.
Remove the affected Beats installer from systems where the patch cannot be applied immediately, until remediation is possible.
Apply least-privilege principles and remove local administrative rights from users who do not require them.

bash

# Example: audit and harden directory ACLs on Windows using icacls
icacls "C:\Program Files\Elastic\Beats" /remove:g "BUILTIN\Users"
icacls "C:\Program Files\Elastic\Beats" /inheritance:r
icacls "C:\Program Files\Elastic\Beats" /grant:r "SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F"