In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known 'safe' permissions. Under those circumstances osquery will load said malicious executable with SYSTEM permissions. The solution is to migrate installations to the 'Program Files' directory on Windows which restricts unprivileged write access. This issue affects osquery prior to v3.4.0.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HLinuxfoundation Osquery
APPLinuxfoundation< 3.4.0
Related vulnerabilities
Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an a...
An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code sign...
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. In osquery bef...
osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured wi...
containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 t...