CVE-2025-23385 Overview
CVE-2025-23385 is a local privilege escalation vulnerability affecting multiple JetBrains developer tools that ship the ETW Host Service component. An authenticated local user can abuse the Event Tracing for Windows (ETW) Host Service to elevate privileges on affected Windows systems. The vulnerability impacts JetBrains ReSharper, Rider, and dotTrace across the 2024.1, 2024.2, and 2024.3 release lines, along with standalone ETW Host Service builds before 16.43. JetBrains categorizes the flaw under [CWE-114] Process Control, indicating that the service loads or executes code from a location a lower-privileged user can influence.
Critical Impact
A local, authenticated attacker can escalate to the privileges of the ETW Host Service, leading to full compromise of confidentiality, integrity, and availability on the host.
Affected Products
- JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7
- JetBrains Rider and dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7
- JetBrains ETW Host Service before 16.43
Discovery Timeline
- 2025-01-28 - CVE-2025-23385 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-23385
Vulnerability Analysis
The vulnerability resides in the JetBrains ETW Host Service, a Windows service installed with ReSharper, Rider, and dotTrace to collect Event Tracing for Windows data during profiling and diagnostics. The service runs with elevated privileges to access kernel-level tracing providers. A low-privileged local user can influence the process-control flow of this service, causing it to execute attacker-controlled code or load attacker-controlled resources in an elevated security context.
Successful exploitation yields code execution at the service's privilege level, which typically translates to SYSTEM or an equivalent high-integrity context on Windows. From that context, attackers can install persistent tooling, disable endpoint controls, dump credentials from LSASS, or move laterally.
Root Cause
JetBrains attributes the issue to [CWE-114] Process Control. This weakness class covers scenarios where a privileged process trusts input, paths, or executable resources that an unprivileged actor controls. In this case, the ETW Host Service does not sufficiently restrict what content it loads or invokes when servicing requests, allowing standard users on the machine to redirect execution.
Attack Vector
The attack vector is local. An attacker must already have valid credentials and interactive or programmatic access to the target host. No user interaction from a second user is required, and attack complexity is low. Developer workstations running JetBrains IDEs are the primary attack surface, and any local malware or foothold on such a workstation can chain this flaw to obtain administrative privileges.
No public proof-of-concept exploit is currently listed for CVE-2025-23385, and the vulnerability is not tracked on the CISA Known Exploited Vulnerabilities catalog. The EPSS probability of exploitation remains low, but developer machines with local admin restrictions are high-value targets for this class of bug.
Detection Methods for CVE-2025-23385
Indicators of Compromise
- Unexpected child processes spawned by the JetBrains ETW Host Service (JetBrains.Etw.Host.Service.exe or similarly named binaries) running under NT AUTHORITY\SYSTEM.
- Writes to JetBrains program directories, temporary paths, or ETW configuration paths performed by non-administrative users prior to service activation.
- New services, scheduled tasks, or persistence artifacts created immediately after ETW Host Service activity on developer endpoints.
Detection Strategies
- Inventory Windows hosts for installed JetBrains ReSharper, Rider, dotTrace, and ETW Host Service versions and flag any build below the fixed releases (2024.3.4, 2024.2.8, 2024.1.7, ETW Host Service 16.43).
- Hunt for process-lineage anomalies where the ETW Host Service launches shells (cmd.exe, powershell.exe), scripting hosts, or LOLBins.
- Correlate local privilege escalation telemetry with recent file writes by standard users into directories consumed by the service.
Monitoring Recommendations
- Enable process creation logging (Windows Event ID 4688 with command line) and Sysmon Event IDs 1, 7, and 11 on developer workstations.
- Alert on integrity-level transitions from Medium to High/System originating from JetBrains service processes.
- Track service binary path modifications and DLL loads from user-writable locations under JetBrains installation trees.
How to Mitigate CVE-2025-23385
Immediate Actions Required
- Upgrade JetBrains ReSharper, Rider, and dotTrace to 2024.3.4, 2024.2.8, or 2024.1.7 (whichever aligns with your release channel) on all developer endpoints.
- Update the standalone JetBrains ETW Host Service to version 16.43 or later.
- Audit local administrator group membership on developer workstations and remove unneeded standing privileges.
Patch Information
JetBrains addressed CVE-2025-23385 in ReSharper, Rider, and dotTrace versions 2024.3.4, 2024.2.8, and 2024.1.7, and in ETW Host Service 16.43. Details are published on the JetBrains Security Issues Fixed page. Apply updates through JetBrains Toolbox, MSI packages, or your software distribution platform.
Workarounds
- If patching cannot occur immediately, stop and disable the JetBrains ETW Host Service on affected hosts to remove the elevated execution surface.
- Restrict write permissions on JetBrains installation and ETW-related directories so only administrators can modify service-loaded content.
- Enforce application allowlisting (for example, Windows Defender Application Control) to prevent unauthorized binaries from executing within the service context.
# Configuration example: stop and disable the vulnerable service on Windows
sc.exe stop "JetBrains ETW Host Service"
sc.exe config "JetBrains ETW Host Service" start= disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
