A privilege escalation vulnerability in Rapid7 assessment tools allows local, low-privileged users to execute code with elevated Scan Engine or SYSTEM/root permissions.

The software fails to validate file ownership when executing discovered executables during authenticated assessments, resulting in execution with unnecessary privileges (CWE-250) for a local attacker.

Successful exploitation allows a local user to bypass security boundaries and execute commands with the privileges of the scanning engine or, in the case of the agent, with root or SYSTEM privileges. This could lead to a full system compromise, allowing an attacker to install persistent backdoors or exfiltrate sensitive data collected during the assessment process. The CVSS score of 7.8 indicates a high risk to the security of the host systems where these agents are deployed.

Immediate Action: Update to Scan Engine content version 1.1.3935 or later for InsightVM and Nexpose, and update the Insight Agent to version 0.0.245.0 or later.

Proactive Monitoring: Audit local system logs for unusual execution patterns or unauthorized attempts to place executables in directories scanned by Rapid7 agents.

Compensating Controls: Restrict local user access to the directories where the scanning engine or agent performs discovery operations to prevent the placement of malicious executables.

Public Exploit Available: Unknown

Administrators should ensure that all Rapid7 components are updated to the specified versions to prevent local privilege escalation. For air-gapped or offline environments, ensure the manual content update process is followed to apply these critical security fixes.