CVE-2022-23511

CVSS V2 None CVSS V3 None
Description
A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-premises servers, in versions up to and including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM permissions. Users with administrative access to affected hosts may use this to create a new command prompt as NT AUTHORITY\SYSTEM. To trigger this issue, the third party must be able to access the affected host and elevate their privileges such that they're able to trigger the agent repair process. They must also be able to install the tools required to trigger the issue. This issue does not affect the CloudWatch Agent for macOS or Linux. Agent users should upgrade to version 1.247355 of the CloudWatch Agent to address this issue. There is no recommended work around. Affected users must update the installed version of the CloudWatch Agent to address this issue.
Overview
  • CVE ID
  • CVE-2022-23511
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2022-12-12T13:15:12
  • Last Modified Date
  • 2023-01-25T15:14:40
Weakness Enumerations
CWE URL
CWE-274 http://cwe.mitre.org/data/definitions/274.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:a:amazon:cloudwatch_agent:*:*:*:*:*:*:*:* 1 OR 1.247355
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* 0 OR
References
Reference URL Reference Tags
https://github.com/aws/amazon-cloudwatch-agent/commit/6119858864c317ff26f41f576c169148d1250837#diff-76ed074a9305c04054cdebb9e9aad2d818052b07091de1f20cad0bbac34ffb52
https://github.com/aws/amazon-cloudwatch-agent/security/advisories/GHSA-j8x2-2m5w-j939
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-23511
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23511
History
Created Old Value New Value Data Type Notes
2022-12-12 13:15:33 Added to TrackCVE
2022-12-12 14:15:48 2022-12-12T13:15:12.120 2022-12-12T13:15:12 CVE Published Date updated
2022-12-12 14:15:48 2022-12-12T13:17:56 CVE Modified Date updated
2022-12-12 14:15:48 Received Awaiting Analysis Vulnerability Status updated
2022-12-12 16:16:28 2022-12-12T15:15:10 CVE Modified Date updated
2022-12-12 16:16:29 A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-premises servers, in versions up to and including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM permissions. Users with administrative access to affected hosts may use this to create a new command prompt as NT AUTHORITY\SYSTEM. To trigger this issue, the third party must be able to access the affected host and elevate their privileges such that they’re able to trigger the agent repair process. They must also be able to install the tools required to trigger the issue. This issue does not affect the CloudWatch Agent for macOS or Linux. Agent users should upgrade to version 1.247355 of the CloudWatch Agent to address this issue. There is no recommended work around. Affected users must update the installed version of the CloudWatch Agent to address this issue. A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-premises servers, in versions up to and including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM permissions. Users with administrative access to affected hosts may use this to create a new command prompt as NT AUTHORITY\SYSTEM. To trigger this issue, the third party must be able to access the affected host and elevate their privileges such that they're able to trigger the agent repair process. They must also be able to install the tools required to trigger the issue. This issue does not affect the CloudWatch Agent for macOS or Linux. Agent users should upgrade to version 1.247355 of the CloudWatch Agent to address this issue. There is no recommended work around. Affected users must update the installed version of the CloudWatch Agent to address this issue. Description updated
2022-12-13 13:18:58 Awaiting Analysis Undergoing Analysis Vulnerability Status updated
2022-12-13 21:14:48 2022-12-13T20:41:18 CVE Modified Date updated
2022-12-13 21:14:48 Undergoing Analysis Analyzed Vulnerability Status updated
2022-12-13 21:14:50 CPE Information updated
2023-01-17 22:17:52 2023-01-17T21:15:11 CVE Modified Date updated
2023-01-17 22:17:52 Analyzed Modified Vulnerability Status updated
2023-01-19 19:12:56 Modified Undergoing Analysis Vulnerability Status updated
2023-01-25 16:13:31 2023-01-25T15:14:40 CVE Modified Date updated
2023-01-25 16:13:31 Undergoing Analysis Analyzed Vulnerability Status updated