PT-2022-4350 · Crowdstrike · Crowdstrike Falcon

Max Moser + 1 · Published 2022-08-22 · Updated 2024-05-17 · CVE-2022-2841

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions CrowdStrike Falcon versions 6.31.14505.0 through 6.44.15806

Description A vulnerability was found in the Uninstallation Handler component of CrowdStrike Falcon, related to incorrect implementation of the uninstall protection function. This leads to missing authorization, allowing an attacker to remove the software without a valid token. The manipulation can be launched remotely.

Recommendations For versions 6.31.14505.0, 6.42.15610, and 6.44.15806, upgrade to version 6.40.15409, 6.42.15611, or 6.44.15807 to address this issue. As a temporary workaround, consider disabling the Uninstallation Handler component until a patch is available. Restrict access to the Uninstallation Protection function to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-691

Related Identifiers

BDU:2022-05210

CVE-2022-2841

Affected Products

Crowdstrike Falcon

References · 10

• 🔥 https://modzero.com/advisories/MZ-22-02-CrowdStrike-FalconSensor.txt · Exploit
• 🔥 https://modzero.com/modlog/archives/2022/08/22/ridiculous_vulnerability_disclosure_process_with_crowdstrike_falcon_sensor/index.html · Exploit
• 🔥 https://exploit-db.com/exploits/51146 · Exploit
• 🔥 https://youtu.be/3If-Fqwx-4s · Exploit
• 🔥 https://vuldb.com/?id.206880 · Exploit
• https://osv.dev/vulnerability/CVE-2022-2841 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05210 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-2841 · Security Note
• https://vuldb.com/?ctiid.206880 · Note
• https://t.me/cvenotify/40943 · Telegram Post