CVE-2025-3771
📋 TL;DR
A path traversal vulnerability in SIR 1.0.3 and earlier allows authenticated non-admin local users to overwrite system files by manipulating backup file paths. This can lead to system crashes or potentially privilege escalation. Only affects systems running vulnerable versions of SIR with authenticated local users.
💻 Affected Systems
- Trellix SIR (Security Incident Response)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via privilege escalation leading to data theft, ransomware deployment, or persistent backdoors.
Likely Case
System instability or crashes from critical file overwrites, requiring system restoration and causing downtime.
If Mitigated
Limited impact with proper access controls and monitoring, potentially only causing service disruption.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of registry manipulation or symbolic link creation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.4 or later
Vendor Advisory: https://thrive.trellix.com/s/article/000014635
Restart Required: Yes
Instructions:
1. Download SIR 1.0.4 or later from Trellix support portal. 2. Backup current configuration. 3. Run installer with administrative privileges. 4. Restart system after installation completes.
🔧 Temporary Workarounds
Restrict Registry Access
windowsLimit write access to Trellix SIR registry keys to administrators only
reg add "HKLM\SOFTWARE\Trellix\SIR" /v BackupPath /t REG_SZ /d "C:\ProgramData\Trellix\SIR\Backups" /f
icacls "HKLM\SOFTWARE\Trellix\SIR" /inheritance:r /grant:r "Administrators:(F)" /grant:r "SYSTEM:(F)"
Disable Symbolic Link Creation
windowsPrevent non-admin users from creating symbolic links via group policy
gpedit.msc -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> 'Create symbolic links' -> Remove all users except Administrators
🧯 If You Can't Patch
- Restrict local user accounts to only trusted personnel with minimal privileges
- Implement file integrity monitoring on critical system directories
🔍 How to Verify
Check if Vulnerable:
Check SIR version via Control Panel Programs or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Trellix\SIR\VersionCheck Version:
reg query "HKLM\SOFTWARE\Trellix\SIR" /v VersionVerify Fix Applied:
Verify version is 1.0.4 or higher and test backup functionality with non-admin user📡 Detection & Monitoring
Log Indicators:
- Unexpected file modifications in system directories
- Failed backup operations with path traversal patterns
- Registry modifications to SIR backup paths by non-admin users
Network Indicators:
- None - local exploitation only
SIEM Query:
EventID=4656 OR EventID=4663 AND ObjectName LIKE '%\system32\%' AND SubjectUserName NOT IN ('SYSTEM','Administrator')