PT-2020-16936 · Fluentd · Td-Agent-Builder Plugin

Published 2020-12-24 · Updated 2025-03-24 · CVE-2020-28169

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions td-agent-builder plugin for Fluentd versions prior to 2020-12-18

Description The issue allows attackers to gain privileges because the bin directory is writable by a user account, but a file in bin is executed as NT AUTHORITYSYSTEM.

Recommendations For versions prior to 2020-12-18, update the td-agent-builder plugin to a version released after 2020-12-18 to resolve the issue. As a temporary workaround, consider restricting write access to the bin directory to prevent exploitation.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2020-28169

DSA-4949-1

Affected Products

Td-Agent-Builder Plugin

References · 14

• 🔥 https://github.com/fluent/fluentd/issues/3201 · Exploit
• 🔥 https://exploit-db.com/exploits/49363 · Exploit
• 🔥 http://packetstormsecurity.com/files/160791/Fluentd-TD-agent-4.0.1-Insecure-Folder-Permission.html · Exploit
• https://github.com/fluent-plugins-nursery/td-agent-builder/pull/247/commits/6f9cb6393392d62caa99907c0ebbcbab6b94a3f1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-28169 · Security Note
• ❌ https://github.com/kenhys/td-agent-builder/commit/eec6e2dedf12f2e0c01c2bbe7b8c15b639b3b938 · Patch, Deleted
• https://debian.org/security/2021/dsa-4949 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4949-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28169 · Vendor Advisory
• https://docs.fluentd.org/installation/install-by-msi · Vendor Advisory
• https://fluentd.org · Vendor Advisory
• https://td-agent-package-browser.herokuapp.com/4/windows · Note
• https://t.me/cibsecurity/21272 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1904170071020199986 · Twitter Post