CVE-2025-25011: Privilege Escalation via Search Path

CVE-2025-25011 Overview

CVE-2025-25011 is an uncontrolled search path element vulnerability [CWE-427] affecting the Elastic Beats Windows installer. The flaw stems from insecure directory permissions applied during installation. A local attacker with low-privileged access can abuse these permissions to move and delete arbitrary files on the host. Successful exploitation can lead to local privilege escalation (LPE) up to SYSTEM. Elastic addressed the issue in Beats Windows Installer 9.1.0 under advisory ESA-2025-12.

Critical Impact
A local, authenticated attacker can escalate privileges to SYSTEM by leveraging insecure directory permissions to move and delete arbitrary files.

Affected Products

Elastic Beats Windows Installer versions prior to 9.1.0
Windows hosts running vulnerable Beats agents (Filebeat, Metricbeat, Winlogbeat, Packetbeat, Auditbeat, Heartbeat)
Systems where the Beats installation directory inherits weak ACLs

Discovery Timeline

2025-07-30 - CVE-2025-25011 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25011

Vulnerability Analysis

The vulnerability originates in how the Elastic Beats Windows installer configures directory access control lists (ACLs). During installation, one or more directories used by the Beats service inherit permissions that allow non-administrative users to write, rename, or delete files. Because the Beats service executes with SYSTEM privileges, any file resolved from an attacker-controlled path is loaded in a high-privilege context.

An attacker with local access places a malicious file, or manipulates existing files, along a search path referenced by the privileged service. When the service starts or reloads, it consumes the attacker-influenced content, resulting in code execution under SYSTEM. This class of issue is commonly referred to as an insecure directory permission or uncontrolled search path weakness.

Root Cause

The root cause is improper handling of directory permissions during installation. Standard users retain modify, delete, or write access to directories that feed into a SYSTEM-level service. The installer does not enforce a restrictive ACL that limits write access to administrators.

Attack Vector

Exploitation requires local access and low privileges. The attacker does not require user interaction. Attack complexity is high because timing and file placement must align with service execution. Successful exploitation impacts confidentiality, integrity, and availability at the highest level on the affected host.

The vulnerability manifests through directory ACL abuse rather than a memory corruption primitive. Refer to the Elastic Security Update ESA-2025-12 for vendor technical details.

Detection Methods for CVE-2025-25011

Indicators of Compromise

Unexpected files, DLLs, or executables written into Beats installation directories by non-administrative accounts.
Modification or deletion of files under the Beats program directory outside of authorized installer or upgrade activity.
New or renamed binaries appearing shortly before a Beats service restart under SYSTEM.
Elevated processes spawned as children of a Beats service that do not match expected agent behavior.

Detection Strategies

Audit ACLs on Beats installation directories on Windows hosts and flag entries granting write, modify, or delete rights to non-administrative principals.
Enable Windows object access auditing on the Beats installation path and alert on write and delete events attributed to standard users.
Correlate file system modification events with subsequent Beats service restarts to identify potential trigger sequences.

Monitoring Recommendations

Monitor Windows Security Event IDs 4663 and 4670 for permission changes and file writes within Beats directories.
Track service state changes for Beats services (Event IDs 7036, 7040) and correlate with recent file activity from non-SYSTEM users.
Alert on child processes of Beats services that deviate from an approved allowlist of expected binaries.

How to Mitigate CVE-2025-25011

Immediate Actions Required

Upgrade the Elastic Beats Windows Installer to version 9.1.0 or later on all Windows hosts running Beats agents.
Inventory all Windows systems with Beats installed and prioritize systems accessible to interactive or low-privileged users.
Review and harden ACLs on Beats installation directories to remove non-administrative write, modify, and delete permissions.
Restart Beats services after applying the patch to ensure the fixed configuration is loaded.

Patch Information

Elastic released the fix in Beats Windows Installer 9.1.0. Details are documented in the Elastic Security Update ESA-2025-12 advisory. The updated installer enforces restrictive directory permissions that prevent standard users from writing to service-controlled paths.

Workarounds

Manually apply restrictive ACLs to the Beats installation directory, granting write and modify rights only to SYSTEM and Administrators.
Restrict local logon on servers running Beats agents to reduce the population of accounts capable of triggering the flaw.
Enforce least privilege on interactive users and remove unnecessary local accounts from affected Windows hosts pending patch deployment.

bash

# Configuration example: restrict ACLs on the Beats install directory (PowerShell)
$path = "C:\Program Files\Elastic\Beats"
icacls $path /inheritance:r
icacls $path /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"