Cve-2025-54100?

PowerShell Universal
1

Hello Guys,

is Powershell Universal effected from this CVE-2025-54100?
I can see Invoke-Webrequest commands in the background.
Without parameter -UseBasicParsing it should run into issues.

regards,
Tyler

2

It looks like PSU update cmdlets do not use the -UseBasicParsing parameter. This will be fixed in the next version. That said, it won’t run these automatically. Can you verify if scripts you have written are doing this?

3

We patched right now. Powershell universal and our apps working fine after the patch.

We do not have a custom script using “Invoke-Webrequest” - but maybe someone else have it.

4

Here are some places where invoke-webrequest is used inside Powershell Universal.
It looks like it is used for the update process and some example scripts.

Update: 
Path: C:\Program Files (x86)\Universal\Modules\Universal\Universal.psm1
    if ($LatestVersion) {
        $Version = (Invoke-WebRequest https://imsreleases.blob.core.windows.net/universal/production/v4-version.txt).Content
    }
    Remove-Item $Zip -Force -ErrorAction SilentlyContinue
    Invoke-WebRequest "https://imsreleases.blob.core.windows.net/universal/production/$version/Universal.$platform.$Version.zip" -OutFile $Zip
    Remove-Item $Zip -Force -ErrorAction SilentlyContinue
    Invoke-WebRequest "https://imsreleases.blob.core.windows.net/universal/production/$version/Universal.$platform.$Version.zip" -OutFile $Zip


Example: 
Path: C:\Program Files (x86)\Universal\Modules\Universal\UniversalDashboard.MaterialUI.psm1
    if ($Url) {
        $WebRequest = Invoke-WebRequest -Uri $Url
        $StringData = $WebRequest.Content
        $ContentType = $WebRequest.Headers["Content-Type"]
    }

Update: 
Path: C:\Program Files (x86)\Universal\Modules\Universal\Universal.psm1
    Remove-Item $Path -Force -Recurse
    Invoke-WebRequest "https://imsreleases.blob.core.windows.net/universal/production/$version/Universal.$platform.$Version.zip" -OutFile $Zip

function Start-UDDownload

If someone can get write access to the target URLs he could easly inject malware into all Powershell Universal instances because they poll for new updates?

imsreleases.blob.core.windows.net/universal/production/v4-version.txt

5

It’s possible but they would need to gain access to our Azure infrastructure. These cmdlets are also not run automatically and need to be done by a user.