PT-2023-15388 · Rsa · Rsa Netwitness Platform

Hyp3Rlinx · Published 2023-03-24 · Updated 2024-04-11 · CVE-2022-47529

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RSA NetWitness Platform versions prior to 12.2

Description The issue allows local and admin Windows user accounts to modify the endpoint agent service configuration, either disabling it completely or running user-supplied code or commands. This bypasses tamper-protection features via ACL modification.

Recommendations For versions prior to 12.2, update to version 12.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the endpoint agent service configuration to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2022-47529

Affected Products

Rsa Netwitness Platform

References · 15

• 🔥 https://github.com/hyp3rlinx/CVE-2022-47529 · Exploit
• 🔥 https://exploit-db.com/exploits/51336 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2023/Mar/26 · Exploit
• 🔥 https://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txt · Exploit
• 🔥 https://packetstormsecurity.com/files/171476/RSA-NetWitness-Endpoint-EDR-Agent-12.x-Incorrect-Access-Control-Code-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-47529 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47529 · Vendor Advisory
• http://seclists.org/fulldisclosure/2024/Apr/17 · Note
• https://t.me/cibsecurity/60890 · Telegram Post
• https://t.me/cvenotify/46988 · Telegram Post
• https://seclists.org/fulldisclosure/2023/Mar/16 · Note
• https://t.me/cvenotify/76393 · Telegram Post
• https://twitter.com/hyp3rlinx/status/1639335477839790105 · Note
• https://community.netwitness.com/t5/netwitness-platform-security/nw-2023-04-netwitness-platform-security-advisory-cve-2022-47529/ta-p/696935 · Note
• https://t.me/defcon_news/111392 · Telegram Post