Vulnerabilities > CVE-2020-11081 - Process Control vulnerability in Linuxfoundation Osquery

CVSS 8.2 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

linuxfoundation

CWE-114

NVD

Published: 2020-07-10

Updated: 2023-01-20

Summary

osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables local escalation. This is fixed in version 4.4.0.

Vulnerable Configurations

Part	Description	Count
Application	Linuxfoundation Linuxfoundation Osquery 0.0.1 Linuxfoundation Osquery 1.0.2 Linuxfoundation Osquery 1.0.3 Linuxfoundation Osquery 1.0.4 Linuxfoundation Osquery 1.0.5 Linuxfoundation Osquery 1.1.0 Linuxfoundation Osquery 1.2.0 Linuxfoundation Osquery 1.2.1 Linuxfoundation Osquery 1.2.2 Linuxfoundation Osquery 1.3.0 Linuxfoundation Osquery 1.3.1 Linuxfoundation Osquery 1.4.0 Linuxfoundation Osquery 1.4.1 Linuxfoundation Osquery 1.4.2 Linuxfoundation Osquery 1.4.3 Linuxfoundation Osquery 1.4.4 Linuxfoundation Osquery 1.4.5 Linuxfoundation Osquery 1.4.6 Linuxfoundation Osquery 1.4.7 Linuxfoundation Osquery 1.5.0 Linuxfoundation Osquery 1.5.1 Linuxfoundation Osquery 1.5.2 Linuxfoundation Osquery 1.5.3 Linuxfoundation Osquery 1.6.0 Linuxfoundation Osquery 1.6.1 Linuxfoundation Osquery 1.6.2 Linuxfoundation Osquery 1.6.3 Linuxfoundation Osquery 1.6.4 Linuxfoundation Osquery 1.7.0 Linuxfoundation Osquery 1.7.1 Linuxfoundation Osquery 1.7.2 Linuxfoundation Osquery 1.7.3 Linuxfoundation Osquery 1.7.4 Linuxfoundation Osquery 1.7.5 Linuxfoundation Osquery 1.7.6 Linuxfoundation Osquery 1.7.7 Linuxfoundation Osquery 1.8.0 Linuxfoundation Osquery 1.8.1 Linuxfoundation Osquery 1.8.2 Linuxfoundation Osquery 2.0.0 Linuxfoundation Osquery 2.1.0 Linuxfoundation Osquery 2.1.1 Linuxfoundation Osquery 2.1.2 Linuxfoundation Osquery 2.2.0 Linuxfoundation Osquery 2.2.1 Linuxfoundation Osquery 2.2.2 Linuxfoundation Osquery 2.2.3 Linuxfoundation Osquery 2.3.0 Linuxfoundation Osquery 2.3.1 Linuxfoundation Osquery 2.3.2 Linuxfoundation Osquery 2.3.3 Linuxfoundation Osquery 2.3.4 Linuxfoundation Osquery 2.4.0 Linuxfoundation Osquery 2.4.1 Linuxfoundation Osquery 2.4.2 Linuxfoundation Osquery 2.4.3 Linuxfoundation Osquery 2.4.4 Linuxfoundation Osquery 2.4.5 Linuxfoundation Osquery 2.4.6 Linuxfoundation Osquery 2.4.7 Linuxfoundation Osquery 2.5.0 Linuxfoundation Osquery 2.5.1 Linuxfoundation Osquery 2.5.2 Linuxfoundation Osquery 2.5.3 Linuxfoundation Osquery 2.6.0 Linuxfoundation Osquery 2.6.1 Linuxfoundation Osquery 2.7.0 Linuxfoundation Osquery 2.8.0 Linuxfoundation Osquery 2.8.1 Linuxfoundation Osquery 2.9.0 Linuxfoundation Osquery 2.9.1 Linuxfoundation Osquery 2.9.2 Linuxfoundation Osquery 2.10.0 Linuxfoundation Osquery 2.10.1 Linuxfoundation Osquery 2.10.2 Linuxfoundation Osquery 2.10.3 Linuxfoundation Osquery 2.10.4 Linuxfoundation Osquery 2.11.0 Linuxfoundation Osquery 2.11.1 Linuxfoundation Osquery 2.11.2 Linuxfoundation Osquery 3.0.0 Linuxfoundation Osquery 3.1.0 Linuxfoundation Osquery 3.2.0 Linuxfoundation Osquery 3.2.1 Linuxfoundation Osquery 3.2.2 Linuxfoundation Osquery 3.2.3 Linuxfoundation Osquery 3.2.4 Linuxfoundation Osquery 3.2.5 Linuxfoundation Osquery 3.2.6 Linuxfoundation Osquery 3.2.7 Linuxfoundation Osquery 3.2.8 Linuxfoundation Osquery 3.2.9 Linuxfoundation Osquery 3.3.0 Linuxfoundation Osquery 3.3.1 Linuxfoundation Osquery 3.3.2 Linuxfoundation Osquery 3.4.0 Linuxfoundation Osquery 4.0.0 Linuxfoundation Osquery 4.0.1 Linuxfoundation Osquery 4.0.2 Linuxfoundation Osquery 4.1.0 Linuxfoundation Osquery 4.1.1 Linuxfoundation Osquery 4.1.2 Linuxfoundation Osquery 4.2.0 Linuxfoundation Osquery 4.3.0	104

Common Weakness Enumeration (CWE)

CWE-114 - Process Control

Common Attack Pattern Enumeration and Classification (CAPEC)

Command Line Execution through SQL Injection
An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References