Local Privilege Escalation via qagent_uninstall.sh Qualys Cloud Agents
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.2.3, 7.1.0, 6.0.0, 6.2.1, 6.3.1, and 6 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges (e.g., via sudo) in an environment where $PATH has been manipulated, an attacker with root/sudo privileges could cause malicious executables to be run in place of the intended system binaries. This behavior can be leveraged for local privilege escalation and arbitrary command execution under elevated privileges.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Qualys Inc Qualys Agent
From 5.0 · fixed in 7.2.3
- Qualys Inc Qualys Agent
From 3.12 · fixed in 7.1.0
- Qualys Inc Qualys Agent
From 4.17 · fixed in 6.0.0
- Qualys Inc Qualys Agent
fixed in 6.2.1
- Qualys Inc Qualys Agent
fixed in 6.3.1
- Qualys Inc Qualys Agent
fixed in 3.31.1-8
- Qualys Inc Qualys Agent
fixed in 3.21.1-6
- Qualys Inc Qualys Agent
fixed in 4.2.6
- Qualys Inc Qualys Agent
fixed in 5.0.3
- Qualys Inc Qualys Agent
fixed in 5.0.2
- Qualys Inc Qualys Agent
fixed in 6.0.3