A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-premises servers, in versions up to and including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM permissions. Users with administrative access to affected hosts may use this to create a new command prompt as NT AUTHORITY\SYSTEM. To trigger this issue, the third party must be able to access the affected host and elevate their privileges such that they're able to trigger the agent repair process. They must also be able to install the tools required to trigger the issue. This issue does not affect the CloudWatch Agent for macOS or Linux. Agent users should upgrade to version 1.247355 of the CloudWatch Agent to address this issue. There is no recommended work around. Affected users must update the installed version of the CloudWatch Agent to address this issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for
    collecting metrics and logs from Amazon EC2 instances and on-premises servers, in versions up to and
    including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM
    permissions. Users with administrative access to affected hosts may use this to create a new command
    prompt as NT AUTHORITY\SYSTEM. To trigger this issue, the third party must be able to access the affected
    host and elevate their privileges such that they're able to trigger the agent repair process. They must
    also be able to install the tools required to trigger the issue. This issue does not affect the CloudWatch
    Agent for macOS or Linux. Agent users should upgrade to version 1.247355 of the CloudWatch Agent to
    address this issue. There is no recommended work around. Affected users must update the installed version
    of the CloudWatch Agent to address this issue. (CVE-2022-23511)

The version of Amazon CloudWatch Agent installed on the remote host is prior to 1.247355. It is, therefore, affected by a vulnerability as referenced in the GHSA-j8x2-2m5w-j939 advisory.

  - A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for     collecting metrics and logs from Amazon EC2 instances and on-premises servers, in versions up to and     including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM     permissions. Users with administrative access to affected hosts may use this to create a new command     prompt as NT AUTHORITY\SYSTEM. To trigger this issue, the third party must be able to access the affected     host and elevate their privileges such that they're able to trigger the agent repair process. They must     also be able to install the tools required to trigger the issue. This issue does not affect the CloudWatch     Agent for macOS or Linux. Agent users should upgrade to version 1.247355 of the CloudWatch Agent to     address this issue. There is no recommended work around. Affected users must update the installed version     of the CloudWatch Agent to address this issue. (CVE-2022-23511)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
416260	SCA: security update for github.com/aws/amazon-cloudwatch-agent (GHSA-j8x2-2m5w-j939)	Tenable Cloud Security	SCA Checks	Local	medium
416260	SCA: security update for github.com/aws/amazon-cloudwatch-agent (GHSA-j8x2-2m5w-j939)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
191143	Amazon CloudWatch Agent < 1.247355 (GHSA-j8x2-2m5w-j939)	Nessus	Windows	Local	medium

Detections

Analytics

CVE-2022-23511

medium

Tenable Plugins

medium

medium

medium