Privilege Escalation Affecting co.elastic.apm:apm-agent-api package, versions [,1.27.0)
Attack Complexity
High
Confidentiality
High
Integrity
High
Availability
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JAVA-COELASTICAPM-2313690
-
published
9 Dec 2021
-
disclosed
9 Dec 2021
-
credit
Unknown
Introduced: 9 Dec 2021
CVE-2021-37941 Open this link in a new tabHow to fix?
Upgrade co.elastic.apm:apm-agent-api to version 1.27.0 or higher.
Overview
Affected versions of this package are vulnerable to Privilege Escalation. A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of permissions than they possess. This vulnerability affects users that have set up the agent via the attacher cli 3, the attach API 2, as well as users that have enabled the profiling_inferred_spans_enabled option