CVE-2019-5629

Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4.

CVSS v3.0 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html	Third Party Advisory VDB Entry
https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529	Third Party Advisory
https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/	Exploit Third Party Advisory
https://seclists.org/bugtraq/2019/Jun/0	Issue Tracking Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2019/Jun/13	Mailing List Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:*:*:*

Information

Published : 2019-07-12 18:15

Updated : 2020-10-16 08:10

NVD link : CVE-2019-5629

Mitre link : CVE-2019-5629

JSON object : View

CWE

CWE-427

Uncontrolled Search Path Element

Advertisement

Products Affected

rapid7

insight_agent

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html", "name": "http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "MISC"}, {"url": "https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529", "name": "https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/", "name": "https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://seclists.org/bugtraq/2019/Jun/0", "name": "20190603 Rapid7's Windows InsightIDR Agent: Local Privilege Escalation", "tags": ["Issue Tracking", "Mailing List", "Third Party Advisory"], "refsource": "BUGTRAQ"}, {"url": "http://seclists.org/fulldisclosure/2019/Jun/13", "name": "20190611 Rapid7's Windows InsightIDR Agent: Local Privilege Escalation", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "FULLDISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at \"C:\\DLLs\\python3.dll,\" which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-427"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-5629", "ASSIGNER": "cve@rapid7.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "acInsufInfo": false, "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}}, "publishedDate": "2019-07-13T01:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.6.3"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-10-16T15:10Z"}