Description
Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 3.1.2.35. This vulnerability is a regression of CVE-2019-5629.
References (2)
Core 2
Core References
Release Notes, Third Party Advisory x_refsource_confirm
https://docs.rapid7.com/release-notes/insightagent/20211210/
Third Party Advisory x_refsource_misc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-5629
Scores
CVSS v3
7.8
EPSS
0.0032
EPSS Percentile
23.4%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-427
Status
published
Products (1)
rapid7/insight_agent
3.0.1 - 3.1.2.35
Published
Dec 14, 2021
Tracked Since
Feb 18, 2026