Rapid7 Insight Agent up to 2024-04-03T120000000Z logging.json improper validation of specified quantity in input

Summaryinfo

A vulnerability marked as problematic has been reported in Rapid7 Insight Agent up to 2024-04-03T120000000Z. Impacted is an unknown function of the file logging.json. Performing a manipulation results in improper validation of specified quantity in input. This vulnerability was named CVE-2024-3185. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic has been found in Rapid7 Insight Agent up to 2024-04-03T120000000Z. This affects an unknown code of the file logging.json. The manipulation with an unknown input leads to a improper validation of specified quantity in input vulnerability. CWE is classifying the issue as CWE-1284. The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an attacker with local access to a machine with the logging.json file to use that key to authenticate to the platform with high privileges. This was fixed in the Rapid7 platform starting 3 April 2024 via the introduction of a restricted role and the removal of automatic API key generation on installation of an agent.

The weakness was presented by Ryan Schachtschneider. It is possible to read the advisory at docs.rapid7.com. This vulnerability is uniquely identified as CVE-2024-3185 since 04/02/2024. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:logging.json it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Rapid7

Name

• Insight Agent

Version

• 2024-04-03T120000000Z

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion