CVE-2019-5629: High severity rapid7 insight agent vulnerability
Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2019-5629?
CVE-2019-5629 is a vulnerability in Rapid7 Insight Agent version 2.6.3 and prior that allows for local privilege escalation.
What is the severity of CVE-2019-5629?
The severity of CVE-2019-5629 is high with a CVSS score of 7.8.
How does CVE-2019-5629 work?
CVE-2019-5629 allows an attacker to escalate their privileges locally by exploiting an uncontrolled DLL search path in Rapid7 Insight Agent.
Is there a fix for CVE-2019-5629?
Yes, upgrading Rapid7 Insight Agent to a version higher than 2.6.3 will fix the vulnerability.
Where can I find more information about CVE-2019-5629?
You can find more information about CVE-2019-5629 at the following references: [link1](http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html), [link2](http://seclists.org/fulldisclosure/2019/Jun/13), [link3](https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/).