CVE-2021-4007 Rapid7 Insight Agent Privilege Escalation
A local attacker can escalate to SYSTEM privileges by exploiting an uncontrolled DLL search path in Rapid7 Insight Agent.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-4007?
CVE-2021-4007 is a high-severity vulnerability in Rapid7 Insight Agent, published on 14 Dec 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 3.1.2.35. This vulnerability is a regression of CVE-2019-5629.
Weakness: CWE-427
Which versions are affected by CVE-2021-4007?
It affects 1 product.
Products include Rapid7 Insight Agent.
How do I fix CVE-2021-4007?
No fix has been published for CVE-2021-4007 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-4007 being exploited?
There is no known exploitation of CVE-2021-4007 in the wild and no public exploit code.
Other vulnerabilities in Rapid7 Insight Agent
- CVE-2026-6482 Local Privilege Escalation via OpenSSL configuration file in Insight Agent
- CVE-2019-5629 Privilege escalation in Insight Agent
- CVE-2026-4482 Insight Agent Private Key Information Disclosure via Inherited File Permissions
- CVE-2026-4837 Eval Injection in Rapid7 Insight Agent
- CVE-2023-2273 Rapid7 Insight Agent Directory Traversal
Sources
Also known as GHSA-r3vg-939c-2mrm.