What is CVE-2021-4007?

CVE-2021-4007 is a vulnerability that affects Rapid7 Insight Agent versions 3.0.1 to 3.1.2.34 and allows for local privilege escalation due to an uncontrolled DLL search path.

How severe is CVE-2021-4007?

CVE-2021-4007 has a severity score of 7.8, which is considered high.

Which Rapid7 Insight Agent versions are affected by CVE-2021-4007?

Rapid7 Insight Agent versions 3.0.1 to 3.1.2.34 are affected by CVE-2021-4007.

How can I fix CVE-2021-4007?

To fix CVE-2021-4007, update Rapid7 Insight Agent to version 3.1.2.35 or later.

Vulnerability/
CVE-2021-4007

high

7.8

CWE

427

14/12/2021

21/11/2024

CVE-2021-4007: Rapid7 Insight Agent Privilege Escalation

Q: How can local privilege escalation occur due to CVE-2021-4007?

Local privilege escalation can occur due to CVE-2021-4007 because when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by a non-administrative user.

First published: Tue Dec 14 2021(Updated: )

Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 3.1.2.35. This vulnerability is a regression of CVE-2019-5629.

Credit: cve@rapid7.con cve@rapid7.com

Affected Software	Affected Version	How to fix
Rapid7 Insight Agent	>=3.0.1<3.1.2.35
	>=3.0.1<3.1.2.35

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2021-4007?
CVE-2021-4007 is a vulnerability that affects Rapid7 Insight Agent versions 3.0.1 to 3.1.2.34 and allows for local privilege escalation due to an uncontrolled DLL search path.
How severe is CVE-2021-4007?
CVE-2021-4007 has a severity score of 7.8, which is considered high.
Which Rapid7 Insight Agent versions are affected by CVE-2021-4007?
Rapid7 Insight Agent versions 3.0.1 to 3.1.2.34 are affected by CVE-2021-4007.
How can local privilege escalation occur due to CVE-2021-4007?
Local privilege escalation can occur due to CVE-2021-4007 because when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by a non-administrative user.
How can I fix CVE-2021-4007?
To fix CVE-2021-4007, update Rapid7 Insight Agent to version 3.1.2.35 or later.

collector/nvd-index
agent/references
agent/type
agent/weakness
agent/title
agent/severity
agent/description
collector/mitre-cve
source/MITRE
agent/first-publish-date
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/last-modified-date
agent/author
agent/tags
agent/softwarecombine
agent/event
vendor/rapid7
canonical/rapid7 insight agent
version/rapid7 insight agent/3.0.1

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.