CVE-2021-3042
📋 TL;DR
This CVE describes a local privilege escalation vulnerability in Palo Alto Networks Cortex XDR agent on Windows. An authenticated local user with file creation privileges in the Windows root directory can execute programs with SYSTEM privileges. This affects Cortex XDR agent versions 6.1, 7.2, and 7.3 without content update 181 or later.
💻 Affected Systems
- Palo Alto Networks Cortex XDR Agent
📦 What is this software?
Cortex Xdr Agent by Paloaltonetworks
Cortex Xdr Agent by Paloaltonetworks
Cortex Xdr Agent by Paloaltonetworks
Cortex Xdr Agent by Paloaltonetworks
Cortex Xdr Agent by Paloaltonetworks
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access and file creation privileges in C:\ could gain full SYSTEM privileges, allowing complete compromise of the Windows system, installation of persistent malware, and bypass of all security controls.
Likely Case
A malicious insider or compromised user account with appropriate file permissions could elevate privileges to SYSTEM, enabling lateral movement, credential theft, and data exfiltration.
If Mitigated
With proper file permissions restricting write access to C:\ and least privilege user accounts, exploitation becomes difficult or impossible.
🎯 Exploit Status
Exploitation requires authenticated local Windows user with file creation privilege in Windows root directory (e.g., C:\)
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Content update 181 or later
Vendor Advisory: https://security.paloaltonetworks.com/CVE-2021-3042
Restart Required: No
Instructions:
1. Ensure Cortex XDR agent is updated to receive content updates automatically. 2. Verify content update 181 or later is applied. 3. No agent restart required as content updates are applied automatically.
🔧 Temporary Workarounds
Restrict file creation in Windows root directory
windowsRemove file creation privileges for standard users in C:\ directory to prevent exploitation
Use Windows Security Policy or Group Policy to restrict write permissions to C:\ for non-administrative users
🧯 If You Can't Patch
- Implement strict file permissions on Windows root directories to prevent unauthorized file creation
- Apply principle of least privilege to user accounts and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Cortex XDR agent version and content update version. If agent is 6.1, 7.2, or 7.3 and content update is earlier than 181, system is vulnerable.Check Version:
Check agent version via Cortex XDR agent interface or management consoleVerify Fix Applied:
Verify content update version is 181 or later in Cortex XDR agent interface or management console📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- File creation in Windows root directory by non-admin users
- Suspicious process execution with SYSTEM privileges
Network Indicators:
- None - this is a local privilege escalation
SIEM Query:
Search for Windows Event ID 4688 (process creation) with elevated privileges from non-admin users, or file creation events in C:\ directory