The Kolide Agent (aka: Launcher) is the lightweight agent designed to work with Kolide's service. An implementation bug in the Kolide Agent (known as `launcher`) allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. The bug was introduced in version 1.5.3 when launcher started storing upgraded binaries in the ProgramData directory. This move to the new directory meant the launcher root directory inherited default permissions that are not as strict as the previous location. These incorrect default permissions in conjunction with an omitted SystemDrive environmental variable (when launcher starts osqueryd), allows a malicious actor with access to the local Windows device to successfully place an arbitrary DLL into the osqueryd process's search path. Under some circumstances, this DLL will be executed when osqueryd performs a WMI query. This combination of events could then allow the attacker to escalate their privileges to SYSTEM. Impacted versions include versions >= 1.5.3 and the fix has been released in 1.12.3.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Kolide Agent (aka: Launcher) is the lightweight agent designed to work with Kolide's service. An
    implementation bug in the Kolide Agent (known as `launcher`) allows for local privilege escalation to the
    SYSTEM user on Windows 10 and 11. The bug was introduced in version 1.5.3 when launcher started storing
    upgraded binaries in the ProgramData directory. This move to the new directory meant the launcher root
    directory inherited default permissions that are not as strict as the previous location. These incorrect
    default permissions in conjunction with an omitted SystemDrive environmental variable (when launcher
    starts osqueryd), allows a malicious actor with access to the local Windows device to successfully place
    an arbitrary DLL into the osqueryd process's search path. Under some circumstances, this DLL will be
    executed when osqueryd performs a WMI query. This combination of events could then allow the attacker to
    escalate their privileges to SYSTEM. Impacted versions include versions >= 1.5.3 and the fix has been
    released in 1.12.3. (CVE-2024-54131)

The version of Kolide Agent for Windows installed on the remote host is greater or equal to 1.5.3 and prior to 1.12.3. It is, therefore, affected by a privilege escalation vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
411252	SCA: security update for github.com/kolide/launcher (GHSA-66q9-2rvx-qfj5)	Tenable Cloud Security	SCA Checks	Local	high
411252	SCA: security update for github.com/kolide/launcher (GHSA-66q9-2rvx-qfj5)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
212756	Kolide Agent for Windows >= 1.5.3 < 1.12.3 Privilege Escalation (CVE-2024-54131)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2024-54131

high

Tenable Plugins

high

high

high