CVE-2025-35471 in miniforge
Summary
by MITRE • 05/13/2025
conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPENSSLDIR, a non-privileged local user can execute arbitrary code with the privileges of the user or process loading openssl-feedstock DLLs. Miniforge before 24.5.0 is also affected.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/13/2025
This vulnerability exists within the conda-forge openssl-feedstock package on Microsoft Windows systems, specifically affecting versions prior to commit 066e83c from May 20, 2024. The flaw stems from improper configuration of OpenSSL's OPENSSLDIR file path which allows non-privileged local users to write to this directory. This represents a classic path traversal and privilege escalation vulnerability that aligns with CWE-276, specifically addressing improper file permissions and insecure default configurations. The vulnerability is particularly concerning because it affects the foundational cryptographic library that many applications depend upon, creating a widespread attack surface.
The technical implementation of this flaw involves the OpenSSL configuration directory being set to a location that lacks proper access controls, enabling local users to inject malicious configuration files. When applications load the affected openssl-feedstock DLLs, they process the specially crafted openssl.cnf file which can contain malicious commands or references to attacker-controlled code. This creates a privilege escalation vector where a low-privilege user can execute arbitrary code with the privileges of the process loading the vulnerable DLLs. The attack requires local system access but does not need network connectivity or remote exploitation capabilities.
The operational impact of this vulnerability extends beyond simple privilege escalation as it affects the entire conda-forge ecosystem on Windows platforms. Applications that depend on OpenSSL for cryptographic operations become vulnerable to code execution attacks, potentially compromising sensitive data and system integrity. The fact that Miniforge versions prior to 24.5.0 are also affected demonstrates the widespread nature of this configuration issue across the Anaconda distribution ecosystem. This vulnerability maps to ATT&CK technique T1068, which covers privilege escalation through local exploitation, and T1547.001, which addresses registry run keys and startup folder modifications.
Mitigation strategies should focus on immediate patching of the affected openssl-feedstock package to commit 066e83c or later versions that properly secure the OPENSSLDIR path. System administrators should also implement proper file permissions on the OpenSSL configuration directories, ensuring that only privileged users or processes can write to these locations. Additionally, monitoring for unauthorized modifications to OpenSSL configuration files should be implemented as part of security operations. Organizations using Miniforge should upgrade to version 24.5.0 or later to address the vulnerability in their distribution. Network segmentation and least privilege principles should be enforced to limit the potential impact of successful exploitation, while regular security audits should verify that OpenSSL configuration files remain secure and unmodified.