CVE-2025-35471: Conda-forge Miniforge RCE Vulnerability

CVE-2025-35471 Overview

CVE-2025-35471 affects the conda-forge openssl-feedstock package on Microsoft Windows. The package configures OpenSSL with an OPENSSLDIR file path that non-privileged local users can write to. A local attacker can place a crafted openssl.cnf file in that directory to execute arbitrary code in the context of any user or process that loads the affected OpenSSL DLLs. Miniforge before 24.5.0 is also affected. The issue is fixed in commit 066e83c (2024-05-20) of the conda-forge openssl-feedstock repository. This is a classic uncontrolled search path element weakness [CWE-427].

Critical Impact
Any local user can achieve arbitrary code execution with the privileges of any user or process on the system that loads the conda-forge OpenSSL DLLs, enabling local privilege escalation when privileged processes consume the package.

Affected Products

conda-forge openssl-feedstock before commit 066e83c (2024-05-20)
conda-forge Miniforge before 24.5.0
Microsoft Windows installations using the affected packages

Discovery Timeline

2025-05-13 - CVE-2025-35471 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-35471

Vulnerability Analysis

The conda-forge build of OpenSSL for Windows compiles the library with an OPENSSLDIR path that resolves to a location writable by non-privileged local users. OpenSSL consults OPENSSLDIR at runtime to locate its configuration file, openssl.cnf. Any process that loads the affected libcrypto or libssl DLLs will parse whatever configuration file exists at that path.

OpenSSL's configuration format supports directives that load external engine and provider modules. An attacker who controls openssl.cnf can therefore direct the loading process into executing attacker-supplied code. The result is arbitrary code execution in the security context of the loading process, which may include SYSTEM-level services or other users' interactive sessions.

Root Cause

The root cause is an insecure default installation path baked into the conda-forge OpenSSL build [CWE-427]. Because the OPENSSLDIR was set to a directory inheriting permissive ACLs, low-privileged users could plant a configuration file. Compounding this, the activation scripts did not explicitly point SSL_CERT_FILE and SSL_CERT_DIR at trusted per-prefix locations, allowing OpenSSL's default configuration lookup to prevail.

Attack Vector

Exploitation requires local access and some user interaction, such as launching a Python interpreter, conda command, or any other application that loads the affected OpenSSL DLLs. The attacker writes a crafted openssl.cnf into the writable OPENSSLDIR, then waits for a higher-privileged user or service to invoke a program linked against the vulnerable OpenSSL build.

The patch addresses the certificate directory handling by explicitly setting environment variables to conda-managed paths during activation:

bat

+@echo off
+if "%SSL_CERT_FILE%"=="" (
+    set SSL_CERT_FILE=%CONDA_PREFIX%\Library\ssl\cacert.pem
+    set __CONDA_OPENSSL_CERT_FILE_SET="1"
+)
+if "%SSL_CERT_DIR%"=="" (
+    set SSL_CERT_DIR=%CONDA_PREFIX%\Library\ssl\certs
+    set __CONDA_OPENSSL_CERT_DIR_SET="1"
+)

Source: conda-forge/openssl-feedstock commit 066e83c

The equivalent PowerShell activation change:

powershell

+if (-not $Env:SSL_CERT_FILE) {
+    $Env:SSL_CERT_FILE = "$Env:CONDA_PREFIX\Library\ssl\cacert.pem"
+    $Env:__CONDA_OPENSSL_CERT_FILE_SET = "1"
+}
+if (-not $Env:SSL_CERT_DIR) {
+    $Env:SSL_CERT_DIR = "$Env:CONDA_PREFIX\Library\ssl\certs"
+    $Env:__CONDA_OPENSSL_CERT_DIR_SET = "1"
+}

Source: conda-forge/openssl-feedstock commit 066e83c

Detection Methods for CVE-2025-35471

Indicators of Compromise

Presence of an unexpected openssl.cnf file in the conda-forge OpenSSL OPENSSLDIR path, particularly if authored by a non-administrator account.
New or modified .dll files referenced as OpenSSL engines or providers in configuration directives such as engines or providers.
Child processes spawned by Python, conda.exe, or other interpreters that load libcrypto-*.dll or libssl-*.dll and immediately execute unexpected binaries.

Detection Strategies

Hunt for file writes to the conda-forge OpenSSL configuration directory by non-privileged users using endpoint file integrity monitoring.
Alert on process load events where a privileged process loads libcrypto or libssl from a conda prefix while an unauthorized openssl.cnf exists at the resolved OPENSSLDIR.
Correlate anomalous DLL loads following OpenSSL initialization to catch engine or provider hijacks.

Monitoring Recommendations

Enable Windows audit policy for object access on the conda-forge OpenSSL install directories to record write attempts.
Inventory hosts running Miniforge below 24.5.0 or openssl-feedstock builds preceding commit 066e83c and prioritize them for review.
Track invocations of conda activate and Python interpreter starts that occur under privileged service accounts.

How to Mitigate CVE-2025-35471

Immediate Actions Required

Upgrade Miniforge to version 24.5.0 or later and update any conda environments that include the openssl package from conda-forge to a build containing commit 066e83c or newer.
Audit the ACLs on the OPENSSLDIR and remove write permissions for non-administrative users on existing installations.
Remove any unauthorized openssl.cnf, engine, or provider files from the affected directories before restarting privileged processes.

Patch Information

The fix is delivered in conda-forge openssl-feedstock commit 066e83c5226bafe90a9c0575b077ce30cd5f5921 dated 2024-05-20 and in Miniforge 24.5.0. The patch sets SSL_CERT_FILE and SSL_CERT_DIR to per-prefix locations under %CONDA_PREFIX%\Library\ssl during environment activation. See conda-forge/openssl-feedstock issue #201 for the full technical discussion.

Workarounds

Manually set OPENSSL_CONF in the environment of privileged processes to point to a trusted, ACL-protected configuration file.
Restrict write access on the conda-forge OpenSSL install directory to administrators only via Windows ACLs.
Avoid running Python or conda-based tooling that loads the affected OpenSSL DLLs under elevated accounts until the environment is upgraded.

bash

# Update Miniforge and the openssl package to a fixed build
conda update -n base -c conda-forge conda
conda install -n base -c conda-forge "openssl>=3.3.0"

# Verify the OPENSSLDIR path and ACLs on Windows (PowerShell)
& "$Env:CONDA_PREFIX\Library\bin\openssl.exe" version -d
icacls "$Env:CONDA_PREFIX\Library\ssl"