CVE-2025-29817: Power Automate Information Disclosure Flaw

CVE-2025-29817 Overview

CVE-2025-29817 is an uncontrolled search path element vulnerability in Microsoft Power Automate for Desktop that allows an authorized attacker to disclose sensitive information over a network. This vulnerability stems from improper handling of the DLL search path, enabling attackers with low-privilege access to potentially hijack the application's library loading mechanism and exfiltrate confidential data.

Critical Impact

An authorized attacker can exploit this vulnerability to disclose sensitive information from affected systems. While the attack requires user interaction and low-level privileges, successful exploitation results in high confidentiality impact.

Affected Products

• Microsoft Power Automate for Desktop (all versions prior to security patch)

Discovery Timeline

• April 15, 2025 - CVE-2025-29817 published to NVD
• July 8, 2025 - Last updated in NVD database

Technical Details for CVE-2025-29817

Vulnerability Analysis

This vulnerability is classified under CWE-427 (Uncontrolled Search Path Element), a class of weakness where an application searches for critical resources such as DLLs in untrusted or attacker-controllable locations. In the case of Power Automate for Desktop, the application fails to properly validate or restrict the search path used when loading dynamic link libraries.

When Power Automate for Desktop initializes or performs certain operations, it attempts to load required DLL files. If the search order is not properly constrained, an attacker can place a malicious DLL in a location that is searched before the legitimate system directories. This is commonly known as a DLL search order hijacking or DLL planting attack.

The vulnerability requires network-based access and an authorized user context, meaning the attacker must have some level of authenticated access to the target environment. Additionally, user interaction is required to trigger the vulnerable code path—such as the victim opening a workflow or document that causes the malicious DLL to be loaded.

Root Cause

The root cause lies in Power Automate for Desktop's failure to implement secure DLL loading practices. Specifically, the application does not restrict the search path to known safe directories before attempting to load required libraries. This allows an attacker to plant a specially crafted DLL in a directory that precedes the legitimate library location in the search order.

Common attack vectors for uncontrolled search path vulnerabilities include:

• Placing malicious DLLs in the current working directory
• Exploiting network shares that are included in the PATH environment variable
• Targeting user-writable directories that appear early in the search sequence

Attack Vector

The attack exploits the network-accessible nature of modern enterprise environments where Power Automate for Desktop operates. An attacker with authorized access to the network can strategically place a malicious DLL file in a location where Power Automate will search for dependencies.

The attack sequence typically involves:

1. The attacker identifies that the target system has Power Automate for Desktop installed
2. The attacker crafts a malicious DLL with the same name as a legitimate library the application loads
3. The malicious DLL is placed in a directory that the application will search before the legitimate location (such as a shared network folder or the application's working directory)
4. When a user launches Power Automate or triggers specific functionality requiring user interaction, the application loads the malicious DLL instead of the legitimate one
5. The malicious code executes with the privileges of the application, enabling information disclosure

Since the vulnerability requires user interaction and low-level authorization, it is most likely to be exploited as part of a larger attack chain or in targeted scenarios where the attacker has established an initial foothold in the environment.

Detection Methods for CVE-2025-29817

Indicators of Compromise

• Unexpected DLL files in Power Automate for Desktop installation directories or working folders
• DLL files with legitimate Microsoft library names located in non-standard paths
• Unusual network activity originating from Power Automate processes
• File system modifications in directories associated with Power Automate workflows

Detection Strategies

• Monitor for DLL loading events from Power Automate processes (PAD.Console.exe, PAD.Robot.exe) that reference non-standard paths
• Implement application whitelisting to detect unauthorized library loading
• Use endpoint detection and response (EDR) solutions to identify DLL search order hijacking attempts
• Review Windows Security Event logs for process creation events with suspicious parent-child relationships involving Power Automate

Monitoring Recommendations

• Enable detailed process auditing on systems running Power Automate for Desktop
• Configure file integrity monitoring for Power Automate installation directories
• Deploy behavioral analytics to detect anomalous data exfiltration patterns from automation tool processes
• Monitor network shares for newly created DLL files with names matching common Windows or Microsoft libraries

How to Mitigate CVE-2025-29817

Immediate Actions Required

• Apply the latest security update from Microsoft for Power Automate for Desktop
• Audit systems for unexpected DLL files in Power Automate directories and working folders
• Restrict write permissions on directories where Power Automate for Desktop operates
• Review and limit network share access to minimize DLL planting opportunities

Patch Information

Microsoft has released a security update addressing CVE-2025-29817. Organizations should apply the patch immediately through their standard update mechanisms. For detailed patch information and download links, refer to the Microsoft Security Update Guide for CVE-2025-29817.

Enterprises using Windows Update for Business or Microsoft Endpoint Configuration Manager should ensure the update is deployed to all systems running Power Automate for Desktop.

Workarounds

• Implement application whitelisting policies to prevent unauthorized DLL loading
• Configure Windows Defender Application Control (WDAC) or AppLocker policies to restrict library loading to trusted locations
• Remove write access to directories in the DLL search path for non-administrative users
• Consider temporarily disabling Power Automate for Desktop on high-risk systems until patching is complete

# PowerShell: Check installed Power Automate version
Get-AppxPackage -Name "*PowerAutomate*" | Select-Object Name, Version

# Review DLL search paths for Power Automate processes
$process = Get-Process -Name "PAD.Console" -ErrorAction SilentlyContinue
if ($process) {
    Write-Host "Power Automate is running - review loaded modules"
    $process.Modules | Select-Object ModuleName, FileName | Format-Table -AutoSize
}