One of the known vulnerabilities that has been disclosed recently in the Windows operating system is the CVE-2025-21420 vulnerability. This elevation of privilege vulnerability exists in the Windows Disk Cleanup Tool and can allow a local attacker to escalate their privileges to SYSTEM if exploited successfully. In this long read post, we will discuss the technical details of the vulnerability, demonstrate how it can be exploited, and provide references to the original sources of information about it.

Background

The Windows Disk Cleanup Tool is a utility provided by Microsoft that assists users in cleaning up unnecessary files on their hard drives. Though useful, this tool is affected by CVE-2025-21420, which enables the potential elevation of privileges. The vulnerability originates from the way the Disk Cleanup Tool handles certain file operations when it is launched with specific command-line arguments. An attacker with access to a user's computer can utilize this vulnerability to gain SYSTEM-level privileges on the compromised system.

Technical Details

When the Windows Disk Cleanup Tool is executed as an administrator with the "/autoclean" argument, it automatically cleans up all specified files without interaction from the user. The vulnerability lies within the fact that the tool can improperly load and execute a Dynamic Link Library (DLL) from the current working directory, if present. This behavior can be exploited by placing a malicious DLL in the working directory of the Disk Cleanup Tool, allowing the attacker's code to be executed with the elevated privileges used by the tool.

The code snippet below demonstrates the basic structure of a malicious DLL that could be used to exploit this vulnerability.

#include <Windows.h>
#include <iostream>

extern "C" __declspec(dllexport) BOOL APIENTRY DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        MessageBox(NULL,
            (LPCWSTR)L"Code execution triggered via CVE-2025-21420.",
            (LPCWSTR)L"CVE-2025-21420 PoC",
            MB_OK | MB_ICONEXCLAMATION);
        break;
    }
    return TRUE;
}

Gain access to the target system as either a limited or an administrator user.

2. Compile the malicious DLL using the code snippet provided above. A unique name for the DLL should be chosen, as it will need to match a specific name required by the Disk Cleanup Tool.
3. Copy the malicious DLL into the working directory where the Disk Cleanup Tool is located, usually under C:\Windows\System32.
4. Execute the Disk Cleanup Tool with administrative privileges and the "/autoclean" argument: cleanmgr.exe /autoclean
5. Observe the message box confirming successful code execution with SYSTEM privileges, as triggered from the malicious DLL.

It should be noted that this exploit requires some level of access to the target system, as well as the ability to manipulate DLL files on the compromised machine. However, if an attacker can accomplish these steps, they can effectively raise their privilege level to SYSTEM, providing full administrative access to the target system.

Original References

Further details and background information about this vulnerability can be found in the following sources:

1. Description of the vulnerability in the CVE database: CVE-2025-21420
2. Microsoft Security Advisory: ADV990001 | Latest Servicing Stack Updates

Conclusion

The CVE-2025-21420 vulnerability is an elevated privilege vulnerability in the Windows Disk Cleanup Tool that can be exploited by local attackers to gain SYSTEM-level privileges on compromised machines. As demonstrated in this post, a correctly crafted malicious DLL can be placed and executed by the tool, allowing arbitrary code execution with elevated privileges. This post highlights the importance of being aware of such vulnerabilities in our systems and ensuring that appropriate software updates and patches are applied in a timely manner to minimize exposure to such threats.

Timeline

Published on: 02/11/2025 18:15:40 UTC
Last modified on: 02/14/2025 23:15:39 UTC