CVE-2022-0237: Rapid7 Insight Agent Privilege Escalation
Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the iragent.exe component, resulting in elevated rights and persistent access to the machine. This issue was fixed in Rapid7 Insight Agent version 3.1.3.80.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this privilege escalation vulnerability?
The vulnerability ID for this privilege escalation vulnerability is CVE-2022-0237.
What is the affected software version?
The affected software version is Rapid7 Insight Agent versions 3.1.2.38 and earlier.
What is the severity rating of CVE-2022-0237?
The severity rating of CVE-2022-0237 is 7.8 (high).
How does the privilege escalation vulnerability in Rapid7 Insight Agent work?
The privilege escalation vulnerability in Rapid7 Insight Agent occurs due to an unquoted argument in the runas.exe command used by the ir_agent.exe component, allowing an attacker to hijack the flow of execution and gain elevated rights.
Are there any known fixes or patches available for CVE-2022-0237?
Yes, the vendor has released a fix for this vulnerability. Users are advised to update to version 3.1.2.39 or later of Rapid7 Insight Agent.