CVE-2025-34352 in Remote Assist
Summary
by MITRE • 12/02/2025
JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\SYSTEM during agent uninstall or update operations. The Remote Assist uninstaller performs privileged create, write, execute, and delete actions on predictable files inside a user-writable %TEMP% subdirectory without validating that the directory is trusted or resetting its ACLs when it already exists. A local, low-privileged attacker can pre-create the directory with weak permissions and leverage mount-point or symbolic-link redirection to (a) coerce arbitrary file writes to protected locations, leading to denial of service (e.g., by overwriting sensitive system files), or (b) win a race to redirect DeleteFileW() to attacker-chosen targets, enabling arbitrary file or folder deletion and local privilege escalation to SYSTEM. This issue is fixed in JumpCloud Remote Assist 0.317.0 and affects Windows systems where Remote Assist is installed and managed through the Agent lifecycle.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 12/02/2025
The vulnerability described in CVE-2025-34352 represents a critical privilege escalation flaw within JumpCloud Remote Assist for Windows versions prior to 0.317.0. This issue stems from improper handling of temporary file operations during the uninstallation or update processes of the JumpCloud Windows Agent. The vulnerability operates at the intersection of Windows privilege management and file system security controls, creating a dangerous attack surface that can be exploited by local low-privileged users to achieve SYSTEM-level privileges. The flaw is particularly concerning because it leverages the legitimate system account NT AUTHORITY\SYSTEM to perform operations that should be restricted and validated, effectively bypassing normal security boundaries that protect critical system resources.
The technical implementation of this vulnerability involves the Remote Assist uninstaller component which executes with elevated privileges but fails to properly validate the security context of the temporary directory it uses for file operations. Specifically, when the uninstaller creates or modifies files within a predictable %TEMP% subdirectory, it does not validate whether the directory has been tampered with or whether its access control lists (ACLs) have been compromised. This design flaw allows attackers to manipulate the temporary directory structure before the uninstaller executes, creating a race condition scenario where the attacker can control the outcome of file operations. The vulnerability specifically affects the DeleteFileW() Windows API function which is used during uninstallation, making it possible for attackers to redirect this function to target files of their choosing rather than the intended system files.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass multiple attack vectors that can lead to complete system compromise. An attacker can exploit this vulnerability to overwrite critical system files, causing denial of service conditions that render the system unstable or unusable. More dangerously, the race condition aspect allows for arbitrary file deletion, enabling attackers to remove critical system components, modify configuration files, or even replace legitimate executables with malicious payloads. This vulnerability directly maps to CWE-276 which describes improper privileges for a resource, and also aligns with ATT&CK technique T1068 which covers privilege escalation through local exploitation. The attack surface is further expanded by the fact that this vulnerability can be triggered through normal agent lifecycle management operations, meaning that exploitation can occur without requiring additional user interaction or special circumstances.
The mitigation strategy for this vulnerability requires immediate deployment of JumpCloud Remote Assist version 0.317.0 which includes proper validation of temporary directory security contexts and implements appropriate ACL checking mechanisms. Organizations should also implement additional security measures such as monitoring for unusual file system activity in temporary directories, particularly during system update or uninstallation operations. System administrators should review and harden the security configuration of temporary directories to prevent unauthorized modification of their contents. The fix addresses the core issue by ensuring that the uninstaller validates directory trustworthiness before performing privileged operations and properly resets directory permissions when existing temporary directories are encountered. This vulnerability underscores the importance of proper privilege separation and the necessity of validating all system operations, particularly those involving elevated privileges and file system modifications that can affect system integrity and security.