Cortex XDR Agent: Improper control of user-controlled file leads to local privilege escalation

A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory or to manipulate key registry values. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.11; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.8; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.3; All versions of Cortex XDR agent 7.2 without content update release 171 or a later version.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

对搜索路径元素未加控制

Palo Alto Networks Cortex XDR Agent 代码问题漏洞

Palo Alto Networks Cortex XDR Agent是马来西亚Palo Alto Networks公司的一个用于检测客户端设备安全性的客户端软件。 Cortex XDR Agent 存在代码问题漏洞，该漏洞源于应用程序以不安全的方式加载DLL库。本地用户，具有在Windows根目录中创建文件的特权，或具有system特权操作键注册表值并在系统上执行任意代码的特权。攻击者可利用该漏洞允许本地用户升级对系统的特权。

N/A

N/A