CVE-2024-52976
📋 TL;DR
This vulnerability allows local attackers with the ability to modify osqueryd configurations to execute arbitrary code via parameter injection in Elastic Agent's subprocess. It affects Elastic Agent installations where osqueryd is configured and accessible to local users. Attackers need existing local access to exploit this vulnerability.
💻 Affected Systems
- Elastic Agent
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, data exfiltration, or lateral movement within the network.
Likely Case
Local user gains elevated privileges or executes unauthorized code within the Elastic Agent context, potentially accessing sensitive data.
If Mitigated
Limited impact due to proper access controls preventing local users from modifying osqueryd configurations.
🎯 Exploit Status
Requires local access and ability to modify osqueryd configurations; parameter injection technique needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.17.25 and 8.15.4
Vendor Advisory: https://discuss.elastic.co/t/elastic-agent-7-17-25-and-8-15-4-security-update-esa-2024-39/377708
Restart Required: Yes
Instructions:
1. Download Elastic Agent 7.17.25 or 8.15.4 from Elastic's official distribution channels. 2. Stop the Elastic Agent service. 3. Install the updated version. 4. Restart the Elastic Agent service.
🔧 Temporary Workarounds
Restrict osqueryd configuration access
linuxLimit write permissions on osqueryd configuration files to trusted users only.
chmod 640 /etc/osquery/osquery.conf
chown root:osquery /etc/osquery/osquery.conf
Disable osqueryd if not needed
allRemove or disable osqueryd integration in Elastic Agent configuration.
Remove osqueryd configuration from elastic-agent.yml
🧯 If You Can't Patch
- Implement strict access controls on osqueryd configuration files to prevent unauthorized modifications.
- Monitor for suspicious modifications to osqueryd configuration files and Elastic Agent subprocess activity.
🔍 How to Verify
Check if Vulnerable:
Check Elastic Agent version and verify if osqueryd is configured and accessible to local users.Check Version:
elastic-agent versionVerify Fix Applied:
Confirm Elastic Agent version is 7.17.25 or higher for 7.x, or 8.15.4 or higher for 8.x.📡 Detection & Monitoring
Log Indicators:
- Unauthorized modifications to osqueryd configuration files
- Unexpected subprocess execution from Elastic Agent
Network Indicators:
- Unusual outbound connections from Elastic Agent processes
SIEM Query:
process.name:osqueryd AND event.action:executed AND user.name NOT IN (trusted_users)