From 56ad2194db03950dc7e7bc9119c45bf169cb1596 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Wed, 10 Jul 2019 16:54:07 -0500 Subject: [PATCH 1/3] CVE-2019-5631 details Covers a product vuln (fixed) in InsightAppSec. --- 2019/5xxx/CVE-2019-5631.json | 126 ++++++++++++++++++++++++++++++----- 1 file changed, 110 insertions(+), 16 deletions(-) diff --git a/2019/5xxx/CVE-2019-5631.json b/2019/5xxx/CVE-2019-5631.json index 6017ea7e335..37c707743c4 100644 --- a/2019/5xxx/CVE-2019-5631.json +++ b/2019/5xxx/CVE-2019-5631.json @@ -1,18 +1,112 @@ { - "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", - "ID": "CVE-2019-5631", - "STATE": "RESERVED" - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", - "description": { - "description_data": [ - { - "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." - } - ] + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "generator": { + "engine": "Vulnogram 0.0.7" + }, + "CVE_data_meta": { + "ID": "CVE-2019-5631", + "ASSIGNER": "cve@rapid7.com", + "DATE_PUBLIC": "2019-07-10T21:30:00.000Z", + "TITLE": "Rapid7 InsightAppSec Local Privilege Escalation", + "AKA": "", + "STATE": "PUBLIC" + }, + "source": { + "defect": [], + "advisory": "R7-2019-26", + "discovery": "EXTERNAL" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Rapid7", + "product": { + "product_data": [ + { + "product_name": "InsightAppSec", + "version": { + "version_data": [ + { + "version_name": "2019.06.24", + "version_affected": "<=", + "version_value": "2019.06.24", + "platform": "" + } + ] + } + } + ] + } + } + ] } -} \ No newline at end of file + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-427: Uncontrolled Search Path Element" + } + ] + } + ] + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Rapid7 InsightAgent suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate their privileges with this vulnerability to the privilege level of InsightAppSec (usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product." + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "CONFIRM", + "url": "https://help.rapid7.com/insightappsec/release-notes/archive/2019/07/", + "name": "https://help.rapid7.com/insightappsec/release-notes/archive/2019/07/" + } + ] + }, + "configuration": [], + "impact": { + "cvss": { + "version": "3.0", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "baseScore": 7.8, + "baseSeverity": "HIGH" + } + }, + "exploit": [], + "work_around": [ + { + "lang": "eng", + "value": "In the absence of a vendor-supplied update, system administrators of machines running Rapid7 InsightAppSec should not grant local logon privileges to untrusted users. " + } + ], + "solution": [ + { + "lang": "eng", + "value": "Users should update Rapid7 InsightAppSec to version 2019.07.08 or later." + } + ], + "credit": [ + { + "lang": "eng", + "value": "This vulnerability was privately reported by security researcher Maciej Oszutowski to Rapid7." + } + ] +} From 73b59e6b54623048a73b4f1105912d00a47029c7 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Fri, 12 Jul 2019 09:10:38 -0500 Subject: [PATCH 2/3] Correctly identify the component --- 2019/5xxx/CVE-2019-5631.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/2019/5xxx/CVE-2019-5631.json b/2019/5xxx/CVE-2019-5631.json index 37c707743c4..fcdbc5b4bb8 100644 --- a/2019/5xxx/CVE-2019-5631.json +++ b/2019/5xxx/CVE-2019-5631.json @@ -60,7 +60,7 @@ "description_data": [ { "lang": "eng", - "value": "Rapid7 InsightAgent suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate their privileges with this vulnerability to the privilege level of InsightAppSec (usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product." + "value": "The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate their privileges with this vulnerability to the privilege level of InsightAppSec (usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product." } ] }, From 5c54a5cb8e4df47c31f52c52422b6f198e5cc7a4 Mon Sep 17 00:00:00 2001 From: Sam Huckins Date: Fri, 16 Aug 2019 15:30:43 -0500 Subject: [PATCH 3/3] Updates to credit and workaround fields --- 2019/5xxx/CVE-2019-5631.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/2019/5xxx/CVE-2019-5631.json b/2019/5xxx/CVE-2019-5631.json index fcdbc5b4bb8..9f7530fbb97 100644 --- a/2019/5xxx/CVE-2019-5631.json +++ b/2019/5xxx/CVE-2019-5631.json @@ -94,7 +94,7 @@ "work_around": [ { "lang": "eng", - "value": "In the absence of a vendor-supplied update, system administrators of machines running Rapid7 InsightAppSec should not grant local logon privileges to untrusted users. " + "value": "If the patching update (2019.07.08 and above) cannot be applied, system administrators of machines running Rapid7 InsightAppSec should not grant local logon privileges to untrusted users. " } ], "solution": [ @@ -106,7 +106,7 @@ "credit": [ { "lang": "eng", - "value": "This vulnerability was privately reported by security researcher Maciej Oszutowski to Rapid7." + "value": "This issue was discovered, and reported to Rapid7, by security researcher Maciej Oszutowski. It is being disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/)." } ] }