From 546ac9cf6db058304a86decb2f174c9d69822bc8 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 3 Dec 2024 20:58:50 +0000
Subject: [PATCH] Publish GHSA-66q9-2rvx-qfj5

---
 .../GHSA-66q9-2rvx-qfj5.json                  | 62 +++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/12/GHSA-66q9-2rvx-qfj5/GHSA-66q9-2rvx-qfj5.json

diff --git a/advisories/github-reviewed/2024/12/GHSA-66q9-2rvx-qfj5/GHSA-66q9-2rvx-qfj5.json b/advisories/github-reviewed/2024/12/GHSA-66q9-2rvx-qfj5/GHSA-66q9-2rvx-qfj5.json
new file mode 100644
index 00000000000..9833df4ab12
--- /dev/null
+++ b/advisories/github-reviewed/2024/12/GHSA-66q9-2rvx-qfj5/GHSA-66q9-2rvx-qfj5.json
@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-66q9-2rvx-qfj5",
+  "modified": "2024-12-03T20:56:58Z",
+  "published": "2024-12-03T20:56:58Z",
+  "aliases": [
+    "CVE-2024-54131"
+  ],
+  "summary": "Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3)",
+  "details": "An implementation bug in the Kolide Agent (known as `launcher`) allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. Impacted versions include versions >= 1.5.3 and the fix has been released in 1.12.3. \n\nThe bug was introduced in version 1.5.3 when launcher started storing upgraded binaries in the ProgramData directory (#1510). This move to the new directory meant the launcher root directory inherited default permissions that are not as strict as the previous location. These incorrect default permissions in conjunction with an omitted SystemDrive environmental variable (when launcher starts osqueryd), allows a malicious actor with access to the local Windows device to successfully place an arbitrary DLL into the osqueryd process's search path. Under some circumstances, this DLL will be executed when osqueryd performs a WMI query. This combination of events could then allow the attacker to escalate their privileges to SYSTEM.\n\nThis issue was found by Bryan Alexander of Atredis Partners and responsibly reported through the Kolide bug bounty program. Kolide made the appropriate changes and released a fix in version 1.12.3 of the `launcher` package.\n",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/kolide/launcher"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.5.3"
+            },
+            {
+              "fixed": "1.12.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/kolide/launcher/security/advisories/GHSA-66q9-2rvx-qfj5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/kolide/launcher/pull/1510"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/kolide/launcher"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-276",
+      "CWE-456"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-03T20:56:58Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file