LibreWolf for Windows Local Privilege Escalation Vulnerability

 LibreWolf for Windows Local Privilege Escalation Vulnerability

Overview

CVE-2025-11940 is a security vulnerability found in the installation process of the LibreWolf browser (version 143.0.4-1 and earlier) running on the Windows operating system. The vulnerability falls into the category of an "Uncontrolled Search Path" or "DLL Preloading" flaw in the installer program (setup.nsi). This allows a local attacker to manipulate the installation process by placing a specially crafted file in a specific location, potentially leading to the execution of malicious code.

• CVSS 3.x/4.0 Score: 7.3 (HIGH)
• Affected Versions: LibreWolf for Windows version 143.0.4-1 and prior.
• Patched Version: LibreWolf for Windows version 144.0-1 and later.
• Vulnerability Type: UNCONTROLLED SEARCH PATH (CWE-427)
• Access Required: Local
• Complexity: High

Technical Analysis of the Vulnerability

The vulnerability resides in the NSIS (Nullsoft Scriptable Install System) based installer program (assets/setup.nsi file) for LibreWolf on Windows.

How Does It Work?

1. Installation Process: When a user runs the LibreWolf_Installer.exe (or similar) to install LibreWolf, the installer performs various operations (extracting files, writing to temporary directories, creating registry entries, etc.).
2. DLL Search Order: When an application (in this case, the installer) requires a Dynamic Link Library (DLL), Windows follows a specific sequence to find this file. Typically, this order is:
   1. The directory from which the application was launched.
   2. System directories (C:\Windows\System32).
   3. The Windows directory.
   4. Directories listed in the PATH environment variable.
3. Manifestation of the Vulnerability: The affected LibreWolf installer unsafely loads DLLs. When searching for one or more system DLLs (e.g., version.dll, propsys.dll), it first checks the current working directory of the application.
4. Attack Vector: An attacker can place a malicious DLL in the directory from which the installation is launched (e.g., the user's Downloads folder) and name it identically to a system DLL the installer looks for (e.g., version.dll).
5. Malicious Code Execution: When the installer is run, it finds and loads the attacker's malicious DLL instead of the legitimate system DLL. This causes the attacker's code to be executed with the privileges of the user who started the installation.

Why Is It This Critical?

• Privilege Escalation: An attacker can execute code in the context of the user running the installer. If the user has administrative privileges, the impact of the attack can be significantly greater.
• Stealth: Since the installation process is a legitimate user-initiated action, it does not raise suspicion.

Example Scenarios

Scenario 1: Attack Triggered from the Downloads Folder

1. An attacker sends a malicious version.dll file to a victim as an email attachment or via a website.
2. The victim unknowingly downloads this file, which is typically saved to C:\Users\[Username]\Downloads.
3. Later, the victim double-clicks the LibreWolf_Installer.exe file located in the same Downloads folder to start the installation.
4. As the installer runs, it searches for version.dll and first looks in its own launch directory (i.e., the Downloads folder).
5. It finds the attacker's malicious version.dll and loads it.
6. The malicious DLL's code is executed with the victim's user account permissions. This code could download and install other malware, steal personal data, or establish persistent access to the system.

Scenario 2: Attack via Network Share 

1. In a corporate environment, there is a shared network drive (\\SERVER\InstallerApps\) used for software installations.
2. An attacker who has breached the internal network, or a malicious insider, places a malicious propsys.dll file on this share.
3. A user runs the LibreWolf installer (LibreWolf_Installer.exe) from this network share.
4. The installer loads the malicious propsys.dll, and the attacker's code is executed within the corporate network, leveraging that user's network credentials and permissions. This could create a foothold for lateral movement inside the network.

Solution and Mitigation Measures 

1. Update: The most effective solution is to update LibreWolf to version 144.0-1 or later. The developers have patched this vulnerability by fixing the installation script (setup.nsi) in the commit with the hash dd10e31dd873e9cb309fad8aed921d45bf905a55.
2. Safe Installation Practices:
   • Always download software installers from official websites (librewolf.net).
   • Run the downloaded installer from a clean directory with restricted write permissions whenever possible (e.g., not directly from a cluttered location like the Downloads folder).
   • Verify file signatures before running installers from suspicious locations.
3. System-Wide Measures:
   • Use user accounts without administrative privileges for daily operations. This greatly limits the impact of a successful attack.
   • Use up-to-date antivirus or next-generation security software.

Conclusion

While CVE-2025-11940 may appear to be a simple "local" vulnerability, it is a privilege escalation flaw that can lead to serious consequences under the right conditions. The presence of such a vulnerability in the installation mechanism of LibreWolf, a security-focused browser, is particularly notable. For users, regularly tracking software updates and adopting secure installation habits are the fundamental keys to protecting against such attacks.

By Cyberhat.Online