CVE-2022-0237 Rapid7 Insight Agent Privilege Escalation
An attacker can escalate privileges and gain persistent access by exploiting an unquoted argument in the runas.exe command within the Insight Agent.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-0237?
CVE-2022-0237 is a medium-severity vulnerability in Rapid7 Insight Agent, published on 17 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in elevated rights and persistent access to the machine. This issue was fixed in Rapid7 Insight Agent version 3.1.3.80.
Which versions are affected by CVE-2022-0237?
It affects 1 product.
Products include Rapid7 Insight Agent.
How do I fix CVE-2022-0237?
No fix has been published for CVE-2022-0237 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-0237 being exploited?
There is no known exploitation of CVE-2022-0237 in the wild and no public exploit code.
Other vulnerabilities in Rapid7 Insight Agent
- CVE-2026-6482 Local Privilege Escalation via OpenSSL configuration file in Insight Agent
- CVE-2021-4007 Rapid7 Insight Agent Privilege Escalation
- CVE-2019-5629 Privilege escalation in Insight Agent
- CVE-2026-4482 Insight Agent Private Key Information Disclosure via Inherited File Permissions
- CVE-2026-4837 Eval Injection in Rapid7 Insight Agent
Sources
Also known as GHSA-7c4x-gmcj-f3mw.