CVE-2021-3041: Cortex XDR Agent: Improper control of user-controlled file leads to local privilege escalation
A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory or to manipulate key registry values. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.11; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.8; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.3; All versions of Cortex XDR agent 7.2 without content update release 171 or a later version.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto Networks Cortex XDR agent (Windows)to a version that resolves this vulnerability.Fixed in 5.0.11 - Upgrade
Upgrade
Palo Alto Networks Cortex XDR agent (Windows)to a version that resolves this vulnerability.Fixed in 6.1.8 - Upgrade
Upgrade
Palo Alto Networks Cortex XDR agent (Windows)to a version that resolves this vulnerability.Fixed in 7.2.3 - Configuration
Ensure Cortex XDR Agent content updates are applied so the fix is included; the provided content updates are required to resolve the issue and are automatically applied for the agent.
Palo Alto Networks Cortex XDR agent (Windows) content updates = automatically apply for the agent
Event History
Frequently Asked Questions
What is CVE-2021-3041?
CVE-2021-3041 is a local privilege escalation vulnerability in the Palo Alto Networks Cortex XDR agent on Windows platforms.
How does CVE-2021-3041 work?
CVE-2021-3041 allows an authenticated local Windows user to execute programs with SYSTEM privileges by creating files in the Windows root directory.
What is the severity of CVE-2021-3041?
CVE-2021-3041 has a severity rating of 7.8 out of 10 (high).
Which software versions are affected by CVE-2021-3041?
Versions 5.0 to 5.0.11, 6.1 to 6.1.8, and 7.2 to 7.2.3 of the Palo Alto Networks Cortex XDR agent on Windows platforms are affected by CVE-2021-3041.
How can I fix CVE-2021-3041?
To fix CVE-2021-3041, update the Palo Alto Networks Cortex XDR agent to a version that is not vulnerable.