CVE-2021-37942
📋 TL;DR
This vulnerability allows a local user to escalate privileges by attaching a malicious plugin to an application running the Elastic APM Java agent. Attackers could execute code with higher permissions than their normal user account. Systems using vulnerable versions of the Elastic APM Java agent are affected.
💻 Affected Systems
- Elastic APM Java Agent
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains root/administrator privileges on the system, leading to complete system compromise.
Likely Case
Local user escalates to the privileges of the application running the APM agent, potentially gaining access to sensitive data or performing unauthorized actions.
If Mitigated
Attack limited to users with local access; proper privilege separation and monitoring would contain impact.
🎯 Exploit Status
Requires local access and ability to attach plugins to running applications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.28.4 and later
Vendor Advisory: https://discuss.elastic.co/t/apm-java-agent-security-update/291355
Restart Required: Yes
Instructions:
1. Download APM Java agent version 1.28.4 or later from Elastic. 2. Replace the existing agent JAR file with the updated version. 3. Restart all Java applications using the APM agent.
🔧 Temporary Workarounds
Restrict local plugin attachment
allImplement access controls to prevent unauthorized users from attaching plugins to running Java applications.
Configure Java security policies to restrict plugin attachment capabilities
🧯 If You Can't Patch
- Restrict local user access to systems running APM Java agent
- Implement strict privilege separation between applications and users
🔍 How to Verify
Check if Vulnerable:
Check the APM agent version: java -jar apm-agent.jar --versionCheck Version:
java -jar apm-agent.jar --versionVerify Fix Applied:
Verify version is 1.28.4 or higher: java -jar apm-agent.jar --version📡 Detection & Monitoring
Log Indicators:
- Unauthorized plugin attachment attempts in APM logs
- Unexpected privilege escalation events in system logs
Network Indicators:
- None - this is a local attack
SIEM Query:
Search for 'plugin attachment' or 'APM agent' events from unauthorized users