CVE-2022-23511: Improper Handling of Insufficient Privileges (CWE-274)
value: A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-premises servers, in versions up to and including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM permissions. Users with administrative access to affected hosts may use this to create a new command prompt as NT AUTHORITY\SYSTEM. To trigger this issue, the third party must be able to access the affected host and elevate their privileges such that they're able to trigger the agent repair process. They must also be able to install the tools required to trigger the issue. This issue does not affect the CloudWatch Agent for macOS or Linux. Agent users should upgrade to version 1.247355 of the CloudWatch Agent to address this issue. There is no recommended work around. Affected users must update the installed version of the CloudWatch Agent to address this issue.
CWE description: The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
CVSS v3 base score: 6.8
Published: 2022-12-12T13:15Z
Repository: https://github.com/aws/amazon-cloudwatch-agent
Language: Go
Files changed: Makefile, cmd/config-translator/translator.go, integration/msi/tools/amazon-cloudwatch-agent.wxs, translator/config/mode.go, translator/context/context.go
Commit date: 2022-08-08 13:00:55 -0400
Commit message: support onprem and onpremise and support windows msi installer w silent exec (#543)

* support onprem and onpremise and support windows msi installer w silent
exec
Diff: diff --git a/Makefile b/Makefile
index 4704332..7ae71e3 100644
--- a/Makefile
+++ b/Makefile
@@ -56,11 +56,11 @@ release: clean test build package-rpm package-deb package-win package-darwin
 nightly-release: release
 
 build: check_secrets cwagent-otel-collector amazon-cloudwatch-agent config-translator start-amazon-cloudwatch-agent amazon-cloudwatch-agent-config-wizard config-downloader
 
 check_secrets::
-	if grep --exclude-dir=build --exclude-dir=vendor -E "(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}|(\"|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)(\"|')?\\s*(:|=>|=)\\s*(\"|')?[A-Za-z0-9/\\+=]{40}(\"|')?" -Rn .; then echo "check_secrets failed"; exit 1; fi;
+	if grep --exclude-dir=build --exclude-dir=vendor -exclude=integration/msi/tools/amazon-cloudwatch-agent.wxs -E "(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}|(\"|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)(\"|')?\\s*(:|=>|=)\\s*(\"|')?[A-Za-z0-9/\\+=]{40}(\"|')?" -Rn .; then echo "check_secrets failed"; exit 1; fi;
 
 create-version-file:
 	@echo Version: ${VERSION}
 	@echo Building time: ${BUILD}
 	echo "$(VERSION)" > CWAGENT_VERSION
diff --git a/cmd/config-translator/translator.go b/cmd/config-translator/translator.go
index 4d2a929..2b7c190 100644
--- a/cmd/config-translator/translator.go
+++ b/cmd/config-translator/translator.go
@@ -26,11 +26,11 @@ const (
 func initFlags() {
 	var inputOs = flag.String("os", "", "Please provide the os preference, valid value: windows/linux.")
 	var inputJsonFile = flag.String("input", "", "Please provide the path of input agent json config file")
 	var inputJsonDir = flag.String("input-dir", "", "Please provide the path of input agent json config directory.")
 	var inputTomlFile = flag.String("output", "", "Please provide the path of the output CWAgent config file")
-	var inputMode = flag.String("mode", "ec2", "Please provide the mode, i.e. ec2, onPremise, auto")
+	var inputMode = flag.String("mode", "ec2", "Please provide the mode, i.e. ec2, onPremise, onPrem, auto")
 	var inputConfig = flag.String("config", "", "Please provide the common-config file")
 	var multiConfig = flag.String("multi-config", "remove", "valid values: default, append, remove")
 	flag.Parse()
 
 	ctx := context.CurrentContext()
diff --git a/integration/msi/tools/amazon-cloudwatch-agent.wxs b/integration/msi/tools/amazon-cloudwatch-agent.wxs
index da45811..b067493 100644
--- a/integration/msi/tools/amazon-cloudwatch-agent.wxs
+++ b/integration/msi/tools/amazon-cloudwatch-agent.wxs
@@ -1,11 +1,9 @@
 <?xml version='1.0' encoding='UTF-8'?>
 <Wix xmlns='http://schemas.microsoft.com/wix/2006/wi'
      xmlns:util='http://schemas.microsoft.com/wix/UtilExtension'>
 
-  <?define FixPermissionScriptAction=""powershell.exe" -ExecutionPolicy Bypass -File "[INSTALLDIR]permission.ps1"?>
-
   <Product Id='*'
     Name='Amazon CloudWatch Agent'
     UpgradeCode='c537c936-91b3-4270-94d7-e128acfc3e86'
     Language='1033'
     Codepage='1252'
@@ -24,11 +22,17 @@
       InstallScope="perMachine"
       Platform="x64"
     />
 
     <MediaTemplate EmbedCab='yes' />
-
+    <Property Id="POWERSHELLEXE">
+      <RegistrySearch Id="POWERSHELLEXE"
+                      Type="raw"
+                      Root="HKLM"
+                      Key="SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell"
+                      Name="Path" />
+    </Property>
     <Feature Id='ProductFeature' Title="Amazon CloudWatch Agent" Level='1'>
       <ComponentRef Id='StarterEXE' />
       <ComponentRef Id='AgentEXE' />
       <ComponentRef Id='WizardEXE' />
       <ComponentRef Id='Ctl' />
@@ -198,15 +202,26 @@
     <DirectoryRef Id="Logs">
         <Component Id='CreateLogsFolder' Guid='fe9042cb-a4fa-4b8e-9852-685a342338b5' Win64='yes'>
             <CreateFolder />
         </Component>
     </DirectoryRef>
-
-    <CustomAction Id="UpdateConfigPermission" Directory="INSTALLDIR" ExeCommand="$(var.FixPermissionScriptAction)" Execute="deferred" Return="check" Impersonate="no" />
+     <!-- Find and use powershell to run the command, because just running "powershell.exe" did not resolve (not in ENV path) when using "WixQuietExec".-->
+    <SetProperty Id="QtExecUpdateConfigPermission" 
+        Sequence="execute"
+        Before ="QtExecUpdateConfigPermission"
+        Value='&quot;[POWERSHELLEXE]&quot;  -ExecutionPolicy Bypass -File "[INSTALLDIR]permission.ps1" ' 
+    />
+    <!-- Setup a silent execution contrainer around the command -->
+    <CustomAction Id="QtExecUpdateConfigPermission" 
+    BinaryKey="WixCA" 
+    DllEntry="WixQuietExec" 
+    Execute="deferred" 
+    Return="check" 
+    Impersonate="no" />
 
     <InstallExecuteSequence>
-        <Custom Action="UpdateConfigPermission" After="InstallFiles">NOT UPGRADINGPRODUCTCODE AND NOT (REMOVE~="ALL")</Custom>
+    <Custom Action="QtExecUpdateConfigPermission" After="InstallFiles">NOT UPGRADINGPRODUCTCODE AND NOT (REMOVE~="ALL")</Custom>
     </InstallExecuteSequence>
 
     <MajorUpgrade AllowDowngrades="yes"/>
   </Product>
 </Wix>
\ No newline at end of file
diff --git a/translator/config/mode.go b/translator/config/mode.go
index 314f293..9b0b748 100644
--- a/translator/config/mode.go
+++ b/translator/config/mode.go
@@ -2,8 +2,9 @@
 // SPDX-License-Identifier: MIT
 
 package config
 
 const (
-	ModeEC2    = "ec2"
-	ModeOnPrem = "onPremise"
+	ModeEC2       = "ec2"
+	ModeOnPrem    = "onPrem"
+        ModeOnPremise = "onPremise"
 )
diff --git a/translator/context/context.go b/translator/context/context.go
index 43eb33e..4670277 100644
--- a/translator/context/context.go
+++ b/translator/context/context.go
@@ -108,11 +108,11 @@ func (ctx *Context) Proxy() map[string]string {
 
 func (ctx *Context) SetMode(mode string) {
 	switch mode {
 	case config.ModeEC2:
 		ctx.mode = config.ModeEC2
-	case config.ModeOnPrem:
+	case config.ModeOnPrem,config.ModeOnPremise:
 		ctx.mode = config.ModeOnPrem
 	default:
 		log.Panicf("Invalid mode %s. Valid mode values are %s and %s.", mode, config.ModeEC2, config.ModeOnPrem)
 	}
 }

Vulnerable code: 	if grep --exclude-dir=build --exclude-dir=vendor -E "(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}|(\"|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)(\"|')?\\s*(:|=>|=)\\s*(\"|')?[A-Za-z0-9/\\+=]{40}(\"|')?" -Rn .; then echo "check_secrets failed"; exit 1; fi;
	var inputMode = flag.String("mode", "ec2", "Please provide the mode, i.e. ec2, onPremise, auto")
  <?define FixPermissionScriptAction=""powershell.exe" -ExecutionPolicy Bypass -File "[INSTALLDIR]permission.ps1"?>



    <CustomAction Id="UpdateConfigPermission" Directory="INSTALLDIR" ExeCommand="$(var.FixPermissionScriptAction)" Execute="deferred" Return="check" Impersonate="no" />
        <Custom Action="UpdateConfigPermission" After="InstallFiles">NOT UPGRADINGPRODUCTCODE AND NOT (REMOVE~="ALL")</Custom>
	ModeEC2    = "ec2"
	ModeOnPrem = "onPremise"
	case config.ModeOnPrem:
Fixed code: 	if grep --exclude-dir=build --exclude-dir=vendor -exclude=integration/msi/tools/amazon-cloudwatch-agent.wxs -E "(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}|(\"|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)(\"|')?\\s*(:|=>|=)\\s*(\"|')?[A-Za-z0-9/\\+=]{40}(\"|')?" -Rn .; then echo "check_secrets failed"; exit 1; fi;
	var inputMode = flag.String("mode", "ec2", "Please provide the mode, i.e. ec2, onPremise, onPrem, auto")
    <Property Id="POWERSHELLEXE">
      <RegistrySearch Id="POWERSHELLEXE"
                      Type="raw"
                      Root="HKLM"
                      Key="SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell"
                      Name="Path" />
    </Property>
     <!-- Find and use powershell to run the command, because just running "powershell.exe" did not resolve (not in ENV path) when using "WixQuietExec".-->
    <SetProperty Id="QtExecUpdateConfigPermission" 
        Sequence="execute"
        Before ="QtExecUpdateConfigPermission"
        Value='&quot;[POWERSHELLEXE]&quot;  -ExecutionPolicy Bypass -File "[INSTALLDIR]permission.ps1" ' 
    />
    <!-- Setup a silent execution contrainer around the command -->
    <CustomAction Id="QtExecUpdateConfigPermission" 
    BinaryKey="WixCA" 
    DllEntry="WixQuietExec" 
    Execute="deferred" 
    Return="check" 
    Impersonate="no" />
    <Custom Action="QtExecUpdateConfigPermission" After="InstallFiles">NOT UPGRADINGPRODUCTCODE AND NOT (REMOVE~="ALL")</Custom>
	ModeEC2       = "ec2"
	ModeOnPrem    = "onPrem"
        ModeOnPremise = "onPremise"
	case config.ModeOnPrem,config.ModeOnPremise: