CVE-2019-3567 Path traversal in osquery
Attackers can execute malicious code with SYSTEM privileges by manipulating file paths in specific osquery configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3567?
CVE-2019-3567 is a high-severity path traversal vulnerability in Facebook osquery, published on 3 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known 'safe' permissions. Under those circumstances osquery will load said malicious executable with SYSTEM permissions. The solution is to migrate installations to the 'Program Files' directory on Windows which restricts unprivileged write access. This issue affects osquery prior to v3.4.0.
Which versions are affected by CVE-2019-3567?
It affects 1 product.
Products include Linuxfoundation Osquery.
How do I fix CVE-2019-3567?
No fix has been published for CVE-2019-3567 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-3567 being exploited?
There is no known exploitation of CVE-2019-3567 in the wild and no public exploit code.
Other vulnerabilities in Facebook osquery
Sources
Also known as GHSA-96gq-m97m-9ppg.