CVE-2025-54422
📋 TL;DR
This vulnerability in Sandboxie exposes user passwords during encrypted sandbox creation and modification. Passwords are transmitted via shared memory and appear as plaintext command-line arguments, allowing any process within the user session to intercept them. All users of Sandboxie versions 1.16.1 and below on Windows NT-based systems are affected.
💻 Affected Systems
- Sandboxie
📦 What is this software?
Sandboxie by Sandboxie Plus
⚠️ Risk & Real-World Impact
Worst Case
Attackers with local access can capture passwords for encrypted sandboxes, potentially accessing sensitive data or bypassing sandbox isolation.
Likely Case
Malware or other local processes could harvest passwords from command-line arguments, compromising sandbox security.
If Mitigated
With proper access controls and monitoring, unauthorized process creation can be detected, limiting exposure.
🎯 Exploit Status
Exploitation requires local access but no special privileges; simple process monitoring can capture passwords.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.16.2
Vendor Advisory: https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-jp7r-vgv9-43p7
Restart Required: Yes
Instructions:
1. Download Sandboxie version 1.16.2 or later from the official repository. 2. Close all sandboxed applications. 3. Run the installer to update. 4. Restart the system to ensure changes take effect.
🔧 Temporary Workarounds
Avoid encrypted sandboxes
windowsTemporarily stop using password-protected encrypted sandboxes until patched.
Restrict process creation
windowsUse application control policies to limit which processes can run in user sessions.
🧯 If You Can't Patch
- Monitor for suspicious process creation and command-line arguments using security tools.
- Limit user privileges and isolate high-risk systems to reduce attack surface.
🔍 How to Verify
Check if Vulnerable:
Check Sandboxie version in Settings > About; if version is 1.16.1 or below, it is vulnerable.Check Version:
wmic product where name="Sandboxie" get versionVerify Fix Applied:
After updating, confirm version is 1.16.2 or higher in Settings > About.📡 Detection & Monitoring
Log Indicators:
- Process creation events for Imbox.exe with command-line arguments containing plaintext passwords
Network Indicators:
- Not applicable - this is a local vulnerability
SIEM Query:
ProcessName="Imbox.exe" AND CommandLine CONTAINS "password"🔗 References
- https://github.com/sandboxie-plus/Sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a
- https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.16.2
- https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-jp7r-vgv9-43p7
- https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-jp7r-vgv9-43p7
