Executive Summary

The Rapid7 Insight Agent (versions > 4.1.0.2) has a local privilege escalation vulnerability on Windows hosts.

When the agent service starts, it tries to load an OpenSSL configuration file from a directory that does not exist but is writable by standard users.

An attacker can place a specially crafted openssl.cnf file in this directory, causing the high-privilege agent service to execute arbitrary commands.

This allows an unprivileged user to bypass security controls and gain SYSTEM level control of the host, effectively achieving full host compromise.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an unprivileged user on a Windows host running the vulnerable Rapid7 Insight Agent to escalate their privileges to SYSTEM level.

With SYSTEM level access, the attacker gains full control over the host, which can lead to unauthorized access to sensitive data, modification or deletion of files, installation of malware, and disruption of system operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unprivileged user to escalate privileges to SYSTEM level on a Windows host, effectively bypassing security controls and achieving full host compromise.

Such a compromise can lead to unauthorized access to sensitive data and systems, which may result in violations of common standards and regulations like GDPR and HIPAA that require strict access controls and protection of personal and health information.

Therefore, the presence of this vulnerability could negatively impact an organization's compliance posture by increasing the risk of data breaches and unauthorized data access.

Useful 0 Not Useful 0