CVE-2019-3567

Name of the Vulnerable Software and Affected Versions osquery versions prior to 3.4.0

Description The issue allows an attacker to inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known 'safe' permissions. Under those circumstances, osquery will load the malicious executable with SYSTEM permissions. This is due to a misconfiguration of access rights in osquery for Windows.

Recommendations For osquery versions prior to 3.4.0, migrate installations to the 'Program Files' directory on Windows, which restricts unprivileged write access.