CVE-2021-4007
Rapid7 Insight Agent Privilege Escalation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 3.1.2.35. This vulnerability is a regression of CVE-2019-5629.
Rapid7 Insight Agent, versiones 3.0.1 a 3.1.2.34, sufre una escalada de privilegios local debido a una ruta de búsqueda de DLL no controlada. En concreto, cuando se inician las versiones 3.0.1 a 3.1.2.34 del Agente Insight, el intérprete de Python intenta cargar python3.dll en "C:\DLLs\python3.dll", que normalmente es escribible por los usuarios autenticados localmente. Debido a esto, un usuario local malicioso podría usar las condiciones de inicio del Agente Insight para elevarse a privilegios SYSTEM. Este problema ha sido corregido en Rapid7 Insight Agent versión 3.1.2.35. Esta vulnerabilidad es una regresión de CVE-2019-5629
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-11-23 CVE Reserved
- 2021-12-14 CVE Published
- 2023-03-08 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-427: Uncontrolled Search Path Element
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-5629 | Third Party Advisory | |
https://docs.rapid7.com/release-notes/insightagent/20211210 | Release Notes |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Rapid7 Search vendor "Rapid7" | Insight Agent Search vendor "Rapid7" for product "Insight Agent" | >= 3.0.1 < 3.1.2.35 Search vendor "Rapid7" for product "Insight Agent" and version " >= 3.0.1 < 3.1.2.35" | - |
Affected
|