CVE-2019-5629

Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html	Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2019/Jun/13	Mailing List Third Party Advisory
https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/	Exploit Third Party Advisory
https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529	Third Party Advisory
https://seclists.org/bugtraq/2019/Jun/0	Issue Tracking Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-07-13 01:15

Updated : 2023-12-10 12:59

NVD link : CVE-2019-5629

Mitre link : CVE-2019-5629

CVE.ORG link : CVE-2019-5629

JSON object : View

Products Affected

rapid7

insight_agent

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2019-5629", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "cve@rapid7.con", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-07-13T01:15:10.447", "references": [{"url": "http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@rapid7.con"}, {"url": "http://seclists.org/fulldisclosure/2019/Jun/13", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@rapid7.con"}, {"url": "https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@rapid7.con"}, {"url": "https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529", "tags": ["Third Party Advisory"], "source": "cve@rapid7.con"}, {"url": "https://seclists.org/bugtraq/2019/Jun/0", "tags": ["Issue Tracking", "Mailing List", "Third Party Advisory"], "source": "cve@rapid7.con"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}, {"type": "Secondary", "source": "cve@rapid7.con", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at \"C:\\DLLs\\python3.dll,\" which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4."}, {"lang": "es", "value": "Insight Agent de Rapid7, versi\u00f3n 2.6.3 y anteriores, sufre de una escalada de privilegios locales debido a una ruta (path) de b\u00fasqueda de DLL no controlada. Espec\u00edficamente, durante el inicio de Insight Agent versi\u00f3n 2.6.3 y anteriores, el int\u00e9rprete de Python intenta cargar python3.dll en \"C:\\DLLs\\python3.dll\", que com\u00fanmente es escribible por usuarios autenticados localmente. Debido a esto, un usuario local malicioso podr\u00eda usar las condiciones de inicio de Insight Agent para elevar los privilegios a SYSTEM. Este problema fue solucionado en Rapid7 Insight Agent versi\u00f3n 2.6.4."}], "lastModified": "2020-10-16T15:10:11.270", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69F19D38-E9AE-46E3-878C-84EFB0D451A1", "versionEndIncluding": "2.6.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@rapid7.con"}