SecBoard
Zurück zur CVE-Übersicht

CVE-2025-11940

HIGH(7.0)

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score18/100 — NIEDRIG
  • CVSS 7 — Hoch

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7

Technische Schwere

Beschreibung

A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are highly complex. The exploitability is reported as difficult. Upgrading to version 144.0-1 mitigates this issue. The name of the patch is dd10e31dd873e9cb309fad8aed921d45bf905a55. It is suggested to upgrade the affected component.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 144.0-1

Threat-Hunting-Queries

Detection for local execution of an unexpected 'schtasks.exe' by the LibreWolf installer.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "librewolf-*.exe"
| where FileName =~ "schtasks.exe"
| where FolderPath contains "\\Users\\"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine

Splunk SPL

index=windows_events EventCode=1 process_name="schtasks.exe" parent_process_name="librewolf-*.exe" | table _time, host, process_name, parent_process_name, command_line, process_path

Sigma

title: LibreWolf Installer EXE Hijacking
status: experimental
description: Detects potential EXE hijacking during LibreWolf installation by monitoring for unexpected schtasks.exe execution.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\librewolf-*.exe'
    Image|endswith: '\schtasks.exe'
  condition: selection
fields:
  - Image
  - ParentImage
  - CommandLine

Elastic ES|QL

from process where event.type == "start" and process.parent.name : "librewolf-*.exe" and process.name : "schtasks.exe" | select @timestamp, host.name, process.parent.name, process.name, process.command_line, process.executable

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (1)

  • dd10e31dd873e9cb309fad8aed921d45bf905a55

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen