Netdata Windows Agent MSI Repair Privilege Escalation

Executive Summary

This vulnerability is a privilege escalation issue in the Netdata Windows Agent installer (MSI package) affecting versions between 2.0.0 and 2.10.3. During the MSI repair process, powershell.exe and wevtutil.exe are launched as elevated interactive processes in the user's desktop session. A low-privileged local attacker can hijack these visible processes to execute arbitrary commands with SYSTEM privileges.

Useful 0 Not Useful 0

Detection Guidance

Check for Netdata Windows Agent versions between 2.0.0 and 2.10.3 or nightly builds between v1.99.0-458 and v23.10.0-781. Look for suspicious powershell.exe or wevtutil.exe processes spawned during MSI repair in C:\Windows\Installer. Monitor for unexpected SYSTEM-level command prompts or process hijacking attempts.

Useful 0 Not Useful 0

Impact Analysis

A local attacker with low privileges could gain full SYSTEM-level access to the affected machine. This could allow them to install malware, modify system files, create new user accounts, or perform other actions with complete control over the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and control of systems, which may violate compliance requirements for data protection and system integrity under standards like GDPR and HIPAA. Unauthorized privilege escalation could result in data breaches or system compromise, triggering regulatory penalties and compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Netdata Windows Agent to version 2.10.4 or later. Remove cached MSI files in C:\Windows\Installer if repair is unnecessary. Restrict local user access to MSI repair operations and monitor for unauthorized process execution.

Useful 0 Not Useful 0