Vulnerability-Lookup

CNVD-2021-02823

Vulnerability from cnvd - Published: 2021-01-14

Title

Palo Alto Networks Cortex XDR Agent代码问题漏洞

Description

Palo Alto Networks Cortex XDR Agent是马来西亚Palo Alto Networks公司的一个用于检测客户端设备安全性的客户端软件。 Palo Alto Networks Cortex XDR存在安全漏洞，该漏洞源于在Windows平台上的代理中存在一个本地特权升级漏洞，攻击者可利用该漏洞经过身份使用系统特权执行程序。

Severity

高

Patch Name

Palo Alto Networks Cortex XDR Agent代码问题漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://security.paloaltonetworks.com/CVE-2020-2049

Reference

https://security.paloaltonetworks.com/CVE-2020-2049

Impacted products

Name
Palo Alto Networks Palo Alto Networks Cortex XDR

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-2049",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-2049"
    }
  },
  "description": "Palo Alto Networks Cortex XDR Agent\u662f\u9a6c\u6765\u897f\u4e9aPalo Alto Networks\u516c\u53f8\u7684\u4e00\u4e2a\u7528\u4e8e\u68c0\u6d4b\u5ba2\u6237\u7aef\u8bbe\u5907\u5b89\u5168\u6027\u7684\u5ba2\u6237\u7aef\u8f6f\u4ef6\u3002\n\nPalo Alto Networks Cortex XDR\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728Windows\u5e73\u53f0\u4e0a\u7684\u4ee3\u7406\u4e2d\u5b58\u5728\u4e00\u4e2a\u672c\u5730\u7279\u6743\u5347\u7ea7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ecf\u8fc7\u8eab\u4efd\u4f7f\u7528\u7cfb\u7edf\u7279\u6743\u6267\u884c\u7a0b\u5e8f\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://security.paloaltonetworks.com/CVE-2020-2049",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-02823",
  "openTime": "2021-01-14",
  "patchDescription": "Palo Alto Networks Cortex XDR Agent\u662f\u9a6c\u6765\u897f\u4e9aPalo Alto Networks\u516c\u53f8\u7684\u4e00\u4e2a\u7528\u4e8e\u68c0\u6d4b\u5ba2\u6237\u7aef\u8bbe\u5907\u5b89\u5168\u6027\u7684\u5ba2\u6237\u7aef\u8f6f\u4ef6\u3002\r\n\r\nPalo Alto Networks Cortex XDR\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728Windows\u5e73\u53f0\u4e0a\u7684\u4ee3\u7406\u4e2d\u5b58\u5728\u4e00\u4e2a\u672c\u5730\u7279\u6743\u5347\u7ea7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ecf\u8fc7\u8eab\u4efd\u4f7f\u7528\u7cfb\u7edf\u7279\u6743\u6267\u884c\u7a0b\u5e8f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Palo Alto Networks Cortex XDR Agent\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Palo Alto Networks Palo Alto Networks Cortex XDR"
  },
  "referenceLink": "https://security.paloaltonetworks.com/CVE-2020-2049",
  "serverity": "\u9ad8",
  "submitTime": "2021-01-08",
  "title": "Palo Alto Networks Cortex XDR Agent\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2020-2049 (GCVE-0-2020-2049)

Vulnerability from cvelistv5 – Published: 2020-12-09 18:00 – Updated: 2024-09-17 02:53

Title

Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation

Summary

A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory. This issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Cortex XDR Agent 7.2 with content update 149 and earlier versions.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-427 - Uncontrolled Search Path Element

Assigner

palo_alto mitre root

References

1 reference

URL	Tags
https://security.paloaltonetworks.com/CVE-2020-2049	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
Palo Alto Networks	Cortex XDR Agent	Unaffected: 7.1.* with content update 150 Affected: 7.1.* without content update 150 Unaffected: 7.2.* with content update 150 Affected: 7.2.* without content update 150
Palo Alto Networks	Cortex XDR Agent	Unaffected: 6.1.* with latest content Unaffected: 7.0.* with latest content

Date Public

2020-12-09 00:00

Credits

Palo Alto Networks thanks Chris Au of PwC Hong Kong - Darklab and Xavier DANEST of Decathlon for discovering and reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:54:00.705Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2020-2049"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows"
          ],
          "product": "Cortex XDR Agent",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "7.1.* with content update 150"
            },
            {
              "status": "affected",
              "version": "7.1.* without content update 150"
            },
            {
              "status": "unaffected",
              "version": "7.2.* with content update 150"
            },
            {
              "status": "affected",
              "version": "7.2.* without content update 150"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Cortex XDR Agent",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "6.1.* with latest content"
            },
            {
              "status": "unaffected",
              "version": "7.0.* with latest content"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Palo Alto Networks thanks Chris Au of PwC Hong Kong - Darklab and Xavier DANEST of Decathlon for discovering and reporting this issue."
        }
      ],
      "datePublic": "2020-12-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory. This issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Cortex XDR Agent 7.2 with content update 149 and earlier versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427 Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-09T18:00:14.000Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2020-2049"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Cortex XDR Agent content update version 150 and all later content update versions resolve this issue for Cortex XDR Agent 7.1 and Cortex XDR Agent 7.2 versions.\n\nCortex XDR Agent 6.1 and Cortex XDR Agent 7.0 are not impacted with the latest content update.\n\nContent updates are automatically applied for the agent. A Cortex XDR Agent version upgrade is not required to resolve this issue."
        }
      ],
      "source": {
        "defect": [
          "CPATR-11314",
          "CPATR-10346"
        ],
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2020-12-09T00:00:00.000Z",
          "value": "Initial publication"
        }
      ],
      "title": "Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation",
      "workarounds": [
        {
          "lang": "en",
          "value": "This issue is mitigated by preventing local authenticated Windows users from creating files in the Windows root directory such as C:\\."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "DATE_PUBLIC": "2020-12-09T17:00:00.000Z",
          "ID": "CVE-2020-2049",
          "STATE": "PUBLIC",
          "TITLE": "Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cortex XDR Agent",
                      "version": {
                        "version_data": [
                          {
                            "platform": "Windows",
                            "version_affected": "!",
                            "version_name": "7.1",
                            "version_value": "7.1.* with content update 150"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "=",
                            "version_name": "7.1",
                            "version_value": "7.1.* without content update 150"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "!",
                            "version_name": "7.2",
                            "version_value": "7.2.* with content update 150"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "=",
                            "version_name": "7.2",
                            "version_value": "7.2.* without content update 150"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "!",
                            "version_name": "6.1",
                            "version_value": "6.1.* with latest content"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "!",
                            "version_name": "7.0",
                            "version_value": "7.0.* with latest content"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Palo Alto Networks thanks Chris Au of PwC Hong Kong - Darklab and Xavier DANEST of Decathlon for discovering and reporting this issue."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory. This issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Cortex XDR Agent 7.2 with content update 149 and earlier versions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-427 Uncontrolled Search Path Element"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.paloaltonetworks.com/CVE-2020-2049",
              "refsource": "MISC",
              "url": "https://security.paloaltonetworks.com/CVE-2020-2049"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Cortex XDR Agent content update version 150 and all later content update versions resolve this issue for Cortex XDR Agent 7.1 and Cortex XDR Agent 7.2 versions.\n\nCortex XDR Agent 6.1 and Cortex XDR Agent 7.0 are not impacted with the latest content update.\n\nContent updates are automatically applied for the agent. A Cortex XDR Agent version upgrade is not required to resolve this issue."
          }
        ],
        "source": {
          "defect": [
            "CPATR-11314",
            "CPATR-10346"
          ],
          "discovery": "EXTERNAL"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2020-12-09T00:00:00.000Z",
            "value": "Initial publication"
          }
        ],
        "work_around": [
          {
            "lang": "en",
            "value": "This issue is mitigated by preventing local authenticated Windows users from creating files in the Windows root directory such as C:\\."
          }
        ],
        "x_affectedList": [
          "Cortex XDR Agent 7.2",
          "Cortex XDR Agent 7.1"
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2020-2049",
    "datePublished": "2020-12-09T18:00:14.602Z",
    "dateReserved": "2019-12-04T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:53:03.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.