A serious flaw in Check Point’s Harmony SASE Windows client enables local attackers to gain system-level privileges.
Identified as CVE-2025-9142, the issue affects versions below 12.2 and stems from poor validation in certificate processing.
Vulnerability Overview
The vulnerability arises in the Perimeter81 service component, which runs with SYSTEM privileges. A local attacker can manipulate the tenant name in a JWT token passed via IPC or URI handler, triggering directory traversal.
This lets the service write or delete files outside its intended folder, such as C:\sleep, by crafting paths like “../../../../../../../../../sleep”.
Check Point rates it medium severity, last updated January 14, 2026. Symptoms include unauthorized file operations during login flows, where Perimeter81.exe hands off from browsers via perimeter81:// URIs.
The client checks allowed domains like perimeter81.com or sase.checkpoint.com variants, but fails to verify JWT signatures properly.
Authentication logic lacks strict trust boundaries. The SaferVPN.Core.Sdp.SdpCertificates class uses a user-supplied WorkingDirectory from the JWT’s tenantId field without signature checks.
Functions like CleanCertFolder() enumerate and delete files in this path, while GenerateAndLoadCertificates() writes private keys, CSRs, and certificates there as SYSTEM.
Attackers register domains like p81-falcon.com once publicly available to host fake auth servers.
They craft signed-looking JWTs with traversal payloads, encode them into URIs, and trigger IPC calls. The service then processes invalid paths, enabling primitives for deletion or writes.
Exploitation Steps
Exploitation follows a precise sequence. First, pre-create a target directory. Invoke the URI handler with a tampered JWT to start certificate flow, delaying the rogue server’s CSR response.
Use Procmon traces to time a symlink swap: replace the directory with an RPC Control-backed junction pointing client.crt to a target like C:\Windows\System32\newfile.dll.
Serve attacker-controlled base64 certificate content. The SYSTEM service writes it, potentially loading malicious DLLs like hostafxr.dll when Perimeter81 restarts.
A PoC video demonstrates popping a SYSTEM shell via automated named pipe connection, local web server, and symlink timing. Microsoft patches like CVE-2024-38014 block older OpLock tricks, but symlinks persist.
Tested on Harmony SASE 11.5.0.2501, all below 12.2 are vulnerable. The client lists 40+ allowed environments, including QA like splinter.saseqa.checkpoint.com, but attackers bypass via unverified JWTs. No remote exploitation; local access suffices, assuming the agent runs.
Check Point advises upgrading to Harmony SASE Windows Agent 12.2 or later via sk182466.
The SK article (sk184557) details symptoms, cause, and fix. The researcher returned p81-falcon.com to aid patching. TLS certificates now block recreating the rogue server setup.
Apply updates immediately from Check Point support. Monitor for anomalous perimeter81:// invocations or Procmon hits on Perimeter81.Service.exe accessing unexpected paths.
Disable URI handlers if unused. Enterprises should scan endpoints with agent 11.x for signs of traversal attempts, like odd certificate folders.
This flaw highlights SASE client risks: privileged services processing web-derived inputs without validation invite escalation.
While domain controls limit wild replication, low-barrier locals underscore agent hardening needs. Check Point’s quick patch shows solid response, but audit similar JWT flows elsewhere.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
