CVE-2021-4007

Rapid7 Insight Agent 3.0.1 to 3.1.2.34 DLL search path privilege escalation

• CVSS 7.8
• CWE-427 Uncontrolled Search Path Element
• Authentication, Authorization, and Session Management
• Local

Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 3.1.2.35. This vulnerability is a regression of CVE-2019-5629.

CVE

CVE-2021-4007

CWE

CWE-427 Uncontrolled Search Path Element

CVSS base score

7.8

Published

2021-12-14

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Local

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Update to Rapid7 Insight Agent version 3.1.2.35 or higher.

import os
import ctypes

def load_python_dll():
    dll_path = r"C:\DLLs\python3.dll"
    if os.path.exists(dll_path):
        ctypes.WinDLL(dll_path)
    else:
        raise FileNotFoundError("The specified DLL does not exist.")

load_python_dll()

import os
import ctypes

def load_python_dll():
    dll_path = r"C:\DLLs\python3.dll"

    if not os.path.isfile(dll_path):
        raise FileNotFoundError("The specified DLL does not exist.")

    if not dll_path.lower().endswith(".dll"):
        raise ValueError("Invalid file type. Expected a .dll file.")

    if os.path.commonpath([dll_path, r"C:\DLLs"]) != r"C:\DLLs":
        raise ValueError("DLL path must be within the allowed directory.")

    try:
        dll = ctypes.WinDLL(dll_path)
    except OSError as e:
        raise RuntimeError(f"Failed to load DLL: {e}")
    return dll

load_python_dll()

@misc{vaitp:cve20214007,
  title        = {{Rapid7 Insight Agent 3.0.1 to 3.1.2.34 DLL search path privilege escalation}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-4007},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-4007/}}
}