cve-2021-22159 – local privilege escalation vulnerability in observeIT windows agent (3rd Feb 2021)

Preface: About decades ago, video recording was used to perform IT system monitoring and governance. The most famous brands are RSA NetWitness and CyberArk. However, products made in Israel provide a cost-effective solution. The software product named “ObserveIT”. The “ObserveIT” software product is now under the umbrella of Proofpoint, Inc..

Vulnerability details: The Proofpoint Insider Threat Management (formerly ObserveIT) Agent for Windows, which allows a local authenticated Windows user to run arbitrary commands with the privileges of the Windows SYSTEM user.

Affected version: before 7.4.3, 7.5.4, 7.6.5, 7.7.5, 7.8.4, 7.9.3, 7.10.2, and 7.11.0.25 as well as versions 7.3 and earlier.

Remedy: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0001

Additional note: If user have access permission to change a file or folder. Meanwhile there is a named service in this directory.
As a result, user can create a payload with “msfvenom” tool. With this payload it can manipulate this specify service. After uploading the payload to system and moved into “common files” directory. When it start, you will receive a session on the system as NT Authority/System.

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.