Critical JumpCloud Windows Agent Flaw Allows Local Privilege Escalation
▼ Summary
– A critical vulnerability (CVE-2025-34352) in JumpCloud’s Remote Assist for Windows agent allowed local privilege escalation and denial-of-service attacks.
– The flaw existed in versions before 0.317.0 and stemmed from the uninstaller performing unsafe file operations in the user-writable Windows %TEMP% directory.
– Because the uninstaller ran with SYSTEM privileges, attackers could redirect its file operations via symbolic links to corrupt or delete critical system files.
– JumpCloud has patched the issue and automatically upgraded all customers to the secure version 0.319.0 of the agent.
– The research underscores that privileged software must avoid or harden interactions with user-writable paths to prevent system compromise.
A critical security flaw has been identified in the JumpCloud Remote Assist for Windows agent, posing a significant threat of local privilege escalation and denial-of-service attacks on managed systems. This vulnerability, designated as CVE-2025-34352, impacts all agent versions released prior to 0.317.0. The weakness originates from insecure file handling procedures during the software’s uninstallation process.
Cybersecurity analysts at XM Cyber discovered the issue, which enables any local user with basic permissions to interfere with file operations executed by the agent. Since the agent runs with the highest SYSTEM-level privileges, this manipulation creates a severe security gap. Attackers can exploit predictable file names and directories that are writable by standard users to achieve complete control over a Windows endpoint or disrupt its normal operation entirely.
The investigation into this risk focused on the agent’s removal procedure. When the main JumpCloud agent is uninstalled, it automatically initiates the removal of the Remote Assist component. This secondary uninstaller carries out numerous file activities within the Windows %TEMP% directory. Crucially, this is a location where any standard user has full write access. Because the uninstaller performs delete, write, and execute commands from this directory while operating as SYSTEM, it becomes susceptible to link-following attacks. Techniques involving symbolic links or mount points can redirect these high-privilege operations toward sensitive and protected areas of the operating system.
JumpCloud serves as a widely adopted cloud platform for identity and device management, supporting over 180,000 organizations globally. Its Windows agent is extensively deployed and requires elevated privileges to perform its core functions of policy enforcement and device management. Successfully leveraging this flaw provides an attacker with persistent, SYSTEM-level access to the compromised machine.
XM Cyber documented several potential attack outcomes. In one instance, arbitrary file writes could corrupt essential Windows drivers, leading to persistent system crashes characterized by blue screens. In a more direct attack path, malicious actors could delete protected system folders and then use standard Windows Installer behaviors to obtain a command shell running with SYSTEM authority.
The vulnerability was responsibly reported to JumpCloud, which confirmed the research findings and promptly issued a corrected version of the Remote Assist agent. All organizations using impacted versions should apply this update without delay. A company representative stated that JumpCloud was informed of the security vulnerability and subsequently patched it in an older release of the Remote Assist Agent. The spokesperson emphasized that securing customer environments is the company’s top priority, noting that an automatic upgrade to version 0.319.0 was rolled out to all customers in late October. Following this deployment, JumpCloud conducted a full audit to verify that the patch was successfully applied across all user environments.
This research underscores an important security principle for businesses: software agents that operate with high privileges must avoid performing operations within directories that standard users can modify, unless those locations have been specifically secured. Even well-documented weaknesses in installation or removal logic can become a direct pathway to total system compromise when they exist within broadly installed management tools.
(Source: Info Security)
