Local privilege escalation via JWT directory traversal and arbitrary file write in Check Point Harmony SASE (Perimeter81) Windows client

CVE-2025-9142 is a local privilege-escalation issue in the Check Point Harmony SASE (Perimeter81) Windows client affecting versions prior to 12.2. The SYSTEM-privileged service component (Perimeter81.Service.exe) accepts a JWT passed during the login flow (initiated via a perimeter81:// URI handler and delivered to the service via IPC) and processes it without proper signature verification. By crafting a tampered JWT (notably manipulating the tenant ID field) containing directory traversal sequences, a local attacker can influence path construction such that the service creates folder structures and writes certificate material outside the intended certificate working directory. The vulnerable certificate generation path is described as GenerateAndLoadCertificates(), which writes client certificates with SYSTEM privileges. The attack can be extended by using Windows symbolic link techniques (e.g., Object Manager / RPC Control directory symlinks) to redirect these privileged writes to arbitrary locations (example given: C:\Windows\System32), enabling overwrite/planting of files (including DLLs). Observed service behavior includes attempting to load missing DLLs from its working directory, which can be leveraged by placing a malicious DLL to achieve code execution upon service restart, yielding SYSTEM-level execution.