The disclosed security threat concerns an Elevation of Privilege (EoP) vulnerability in Microsoft Defender for Endpoint (MDE) on Linux platforms, identified as CVE-2025-47161. This vulnerability affects multiple recent builds of MDE released between January and March 2025, specifically versions 101.24102.0000 through 101.25012.0000. The exploit leverages a local attack vector, requiring the attacker to have local access to the affected system. The provided exploit code is a proof-of-concept that demonstrates how an attacker can escalate privileges by abusing the dynamic loading of OpenSSL engines. The exploit compiles a malicious shared library (woot.so) written in C, which is loaded via a crafted OpenSSL configuration file (openssl.cnf). This malicious engine executes arbitrary commands with elevated privileges, exemplified by dumping process information to a file (/woot.txt). The attack involves creating a specially crafted OpenSSL configuration directory structure and configuration file that forces MDE or related processes to load the malicious shared object. The exploit is tested on Ubuntu 24.04.1 and 24.04.2 LTS, indicating the vulnerability is relevant to Linux distributions commonly used in enterprise environments. Although no known exploits are reported in the wild yet, the availability of public exploit code significantly raises the risk of exploitation. The vulnerability allows an attacker with local access to escalate their privileges, potentially gaining root-level control over the system. This can lead to full system compromise, bypassing security controls enforced by MDE. The vulnerability is particularly critical because MDE is a security product expected to protect endpoints, and its compromise undermines the overall security posture. The exploit requires local access and no user interaction beyond executing the exploit script, making it suitable for attackers who have already gained limited access and want to deepen their foothold.

For European organizations, this vulnerability poses a significant risk, especially those relying on Microsoft Defender for Endpoint on Linux servers or workstations. The ability to escalate privileges locally can allow attackers to bypass endpoint protection, disable security monitoring, and move laterally within networks. This can lead to data breaches, disruption of critical services, and loss of integrity and availability of systems. Organizations in sectors such as finance, healthcare, government, and critical infrastructure are particularly at risk due to the sensitive nature of their data and the criticality of their operations. The exploitation of this vulnerability could facilitate advanced persistent threats (APTs) and ransomware attacks by providing attackers with elevated privileges to deploy further payloads or exfiltrate data. Additionally, since the exploit targets Linux versions of MDE, organizations with hybrid environments or Linux-heavy infrastructures are more exposed. The lack of a patch at the time of disclosure and the presence of public exploit code increase the urgency for mitigation to prevent exploitation in European enterprises.

1. Immediate deployment of any available patches or updates from Microsoft addressing CVE-2025-47161 is critical. Monitor Microsoft's official security update channels for releases. 2. Restrict local access to systems running MDE on Linux to trusted users only, employing strict access controls and multi-factor authentication for administrative accounts. 3. Implement application whitelisting and integrity monitoring to detect unauthorized changes to OpenSSL configuration files and shared libraries, particularly in directories related to MDE and OpenSSL. 4. Monitor system logs and file system changes for suspicious activity, such as unexpected creation of shared objects or modifications to openssl.cnf files. 5. Use endpoint detection and response (EDR) tools to identify anomalous process executions and privilege escalations. 6. Employ network segmentation to limit lateral movement from compromised hosts. 7. Conduct regular security audits and vulnerability assessments focusing on endpoint security solutions and their configurations. 8. Educate system administrators and security teams about this vulnerability and the importance of monitoring for local privilege escalation attempts. 9. Consider temporarily disabling or restricting the use of vulnerable MDE builds on Linux until patches are applied, if operationally feasible.