Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in elevated rights and persistent access to the machine. This issue was fixed in Rapid7 Insight Agent version 3.1.3.80.
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
| Link | Tags |
|---|---|
| https://docs.rapid7.com/release-notes/insightagent/20220225/ | release notes vendor advisory |
| https://gist.github.com/n2dez/05d43c616f2b403e84ee55d4d7aab251 | third party advisory exploit |