CVE-2025-7619: BatchSignCS Arbitrary File Write Vulnerability

CVE-2025-7619 Overview

CVE-2025-7619 is an arbitrary file write vulnerability in BatchSignCS, a background Windows application developed by WellChoose. The flaw allows remote attackers to write files to any path on the host when a user visits a malicious website while the application is running. Successful exploitation can lead to arbitrary code execution by planting executables, scripts, or configuration files in privileged locations. The weakness is categorized under CWE-23 (Relative Path Traversal).

Critical Impact
Remote attackers can write arbitrary files to any filesystem path via a malicious webpage, enabling arbitrary code execution on affected Windows hosts running BatchSignCS.

Affected Products

WellChoose BatchSignCS background Windows application
Windows endpoints with BatchSignCS running as a background service
Browsers used to access untrusted sites while BatchSignCS is active

Discovery Timeline

2025-07-14 - CVE-2025-7619 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-7619

Vulnerability Analysis

BatchSignCS runs locally as a background process and exposes functionality that can be reached from a web origin. The application accepts file path inputs without enforcing canonical path validation. An attacker hosting a crafted webpage can issue requests to the local BatchSignCS endpoint while a victim browses the site. Those requests carry attacker-controlled file paths and contents, which the service writes to disk under the privileges of the BatchSignCS process. The Taiwan Computer Emergency Response Team has published advisories detailing the issue in the TWCert Security Report and the TWCert Incident Notification.

Root Cause

The vulnerability stems from improper neutralization of path traversal sequences in file path parameters processed by BatchSignCS. The application fails to restrict writes to a designated working directory. Relative path components such as ..\ allow attackers to escape any intended boundary. This matches the [CWE-23] Relative Path Traversal weakness pattern.

Attack Vector

Exploitation requires that the victim run BatchSignCS in the background and visit an attacker-controlled web page. The malicious page issues cross-origin or local loopback requests to the BatchSignCS listener. The attacker supplies a destination path and file contents. Code execution can follow by dropping payloads into autostart locations such as the Startup folder, scheduled task definitions, or DLL search paths used by other applications.

No public proof-of-concept code is available. Refer to the TWCert advisories for vendor-provided technical context.

Detection Methods for CVE-2025-7619

Indicators of Compromise

Unexpected files written under user profile directories, Startup folders, or Program Files paths while BatchSignCS.exe is active
Outbound browser connections to loopback ports associated with BatchSignCS immediately followed by new file creation events
Process creation events where BatchSignCS.exe spawns or is followed by execution of newly written binaries or scripts
File writes by BatchSignCS containing path traversal sequences such as ..\..\ in request logs

Detection Strategies

Monitor file create and write events generated by BatchSignCS.exe and alert when the target path falls outside the application's expected working directory
Inspect HTTP traffic to BatchSignCS loopback listeners for parameters containing traversal sequences or absolute Windows paths
Correlate browser process activity with subsequent file writes performed by BatchSignCS within a short time window
Hunt for persistence artifacts created in \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup while BatchSignCS is running

Monitoring Recommendations

Enable Windows file system auditing on sensitive directories including system, startup, and scheduled task paths
Forward Sysmon Event IDs 1 (process create) and 11 (file create) for BatchSignCS.exe to centralized logging
Baseline the legitimate file write behavior of BatchSignCS and alert on deviations
Track network connections to the BatchSignCS local listener from browser processes

How to Mitigate CVE-2025-7619

Immediate Actions Required

Stop the BatchSignCS background service on endpoints that do not require signing functionality
Restrict outbound browser access to untrusted sites on workstations where BatchSignCS must remain running
Apply the vendor-supplied patch referenced in the TWCert Security Report as soon as it is available in your environment
Audit endpoints for unexpected files created in startup or system directories since BatchSignCS was installed

Patch Information

WellChoose has been notified through TWCert. Administrators should consult the TWCert Incident Notification for the fixed build identifier and obtain the updated BatchSignCS installer directly from WellChoose. Deploy the patched version through standard software distribution channels and confirm the update by checking the executable version metadata.

Workarounds

Terminate BatchSignCS.exe when signing operations are not in progress
Use host firewall rules to block non-authorized processes from connecting to the BatchSignCS loopback port
Configure browsers to deny access to local network and loopback resources from internet-zone sites
Apply application control policies that prevent execution of binaries written into user-writable directories

bash

# Example: block loopback access from browsers using Windows Defender Firewall
New-NetFirewallRule -DisplayName "Block Browser to BatchSignCS Loopback" `
  -Direction Outbound -Program "C:\Program Files\Google\Chrome\Application\chrome.exe" `
  -RemoteAddress 127.0.0.1 -Action Block