CVE-2022-23511 (published 2022-12-12T13:15Z)

A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-premises servers, in versions up to and including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM permissions. Users with administrative access to affected hosts may use this to create a new command prompt as NT AUTHORITY\\SYSTEM. To trigger this issue, the third party must be able to access the affected host and elevate their privileges such that they're able to trigger the agent repair process. They must also be able to install the tools required to trigger the issue. This issue does not affect the CloudWatch Agent for macOS or Linux. Agent users should upgrade to version 1.247355 of the CloudWatch Agent to address this issue. There is no recommended work around. Affected users must update the installed version of the CloudWatch Agent to address this issue.

CVSS v3 base score: 6.8, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-274
cwe_name: Improper Handling of Insufficient Privileges
description: The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/aws/amazon-cloudwatch-agent
commit_details: repo_url: https://github.com/aws/amazon-cloudwatch-agent
author: Ameen
author_date: 2022-08-08 13:00:55-04:00
msg: support onprem and onpremise and support windows msi installer w silent exec (#543)

* support onprem and onpremise and support windows msi installer w silent
exec
repository: repo_url: https://github.com/aws/amazon-cloudwatch-agent
repo_name: aws/amazon-cloudwatch-agent
description: CloudWatch Agent enables you to collect and export host-level metrics and logs on instances running Linux or Windows server.
repo_language: Go
owner: aws
file_changes: filename: Makefile
change_type: ModificationType.MODIFY
diff: @@ -58,7 +58,7 @@ nightly-release: release
 build: check_secrets cwagent-otel-collector amazon-cloudwatch-agent config-translator start-amazon-cloudwatch-agent amazon-cloudwatch-agent-config-wizard config-downloader
 
 check_secrets::
-	if grep --exclude-dir=build --exclude-dir=vendor -E "(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}|(\"|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)(\"|')?\\s*(:|=>|=)\\s*(\"|')?[A-Za-z0-9/\\+=]{40}(\"|')?" -Rn .; then echo "check_secrets failed"; exit 1; fi;
+	if grep --exclude-dir=build --exclude-dir=vendor -exclude=integration/msi/tools/amazon-cloudwatch-agent.wxs -E "(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}|(\"|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)(\"|')?\\s*(:|=>|=)\\s*(\"|')?[A-Za-z0-9/\\+=]{40}(\"|')?" -Rn .; then echo "check_secrets failed"; exit 1; fi;
 
 create-version-file:
 	@echo Version: ${VERSION}

programming_language: Shell
filename: translator.go
change_type: ModificationType.MODIFY
diff: @@ -28,7 +28,7 @@ func initFlags() {
 	var inputJsonFile = flag.String("input", "", "Please provide the path of input agent json config file")
 	var inputJsonDir = flag.String("input-dir", "", "Please provide the path of input agent json config directory.")
 	var inputTomlFile = flag.String("output", "", "Please provide the path of the output CWAgent config file")
-	var inputMode = flag.String("mode", "ec2", "Please provide the mode, i.e. ec2, onPremise, auto")
+	var inputMode = flag.String("mode", "ec2", "Please provide the mode, i.e. ec2, onPremise, onPrem, auto")
 	var inputConfig = flag.String("config", "", "Please provide the common-config file")
 	var multiConfig = flag.String("multi-config", "remove", "valid values: default, append, remove")
 	flag.Parse()

programming_language: Go
filename: amazon-cloudwatch-agent.wxs
change_type: ModificationType.MODIFY
diff: @@ -2,8 +2,6 @@
 <Wix xmlns='http://schemas.microsoft.com/wix/2006/wi'
      xmlns:util='http://schemas.microsoft.com/wix/UtilExtension'>
 
-  <?define FixPermissionScriptAction=""powershell.exe" -ExecutionPolicy Bypass -File "[INSTALLDIR]permission.ps1"?>
-
   <Product Id='*'
     Name='Amazon CloudWatch Agent'
     UpgradeCode='c537c936-91b3-4270-94d7-e128acfc3e86'
@@ -26,7 +24,13 @@
     />
 
     <MediaTemplate EmbedCab='yes' />
-
+    <Property Id="POWERSHELLEXE">
+      <RegistrySearch Id="POWERSHELLEXE"
+                      Type="raw"
+                      Root="HKLM"
+                      Key="SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell"
+                      Name="Path" />
+    </Property>
     <Feature Id='ProductFeature' Title="Amazon CloudWatch Agent" Level='1'>
       <ComponentRef Id='StarterEXE' />
       <ComponentRef Id='AgentEXE' />
@@ -200,11 +204,22 @@
             <CreateFolder />
         </Component>
     </DirectoryRef>
-
-    <CustomAction Id="UpdateConfigPermission" Directory="INSTALLDIR" ExeCommand="$(var.FixPermissionScriptAction)" Execute="deferred" Return="check" Impersonate="no" />
+     <!-- Find and use powershell to run the command, because just running "powershell.exe" did not resolve (not in ENV path) when using "WixQuietExec".-->
+    <SetProperty Id="QtExecUpdateConfigPermission" 
+        Sequence="execute"
+        Before ="QtExecUpdateConfigPermission"
+        Value='&quot;[POWERSHELLEXE]&quot;  -ExecutionPolicy Bypass -File "[INSTALLDIR]permission.ps1" ' 
+    />
+    <!-- Setup a silent execution contrainer around the command -->
+    <CustomAction Id="QtExecUpdateConfigPermission" 
+    BinaryKey="WixCA" 
+    DllEntry="WixQuietExec" 
+    Execute="deferred" 
+    Return="check" 
+    Impersonate="no" />
 
     <InstallExecuteSequence>
-        <Custom Action="UpdateConfigPermission" After="InstallFiles">NOT UPGRADINGPRODUCTCODE AND NOT (REMOVE~="ALL")</Custom>
+    <Custom Action="QtExecUpdateConfigPermission" After="InstallFiles">NOT UPGRADINGPRODUCTCODE AND NOT (REMOVE~="ALL")</Custom>
     </InstallExecuteSequence>
 
     <MajorUpgrade AllowDowngrades="yes"/>

programming_language: PowerShell
filename: mode.go
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,7 @@
 package config
 
 const (
-	ModeEC2    = "ec2"
-	ModeOnPrem = "onPremise"
+	ModeEC2       = "ec2"
+	ModeOnPrem    = "onPrem"
+        ModeOnPremise = "onPremise"
 )

programming_language: Go
filename: context.go
change_type: ModificationType.MODIFY
diff: @@ -110,7 +110,7 @@ func (ctx *Context) SetMode(mode string) {
 	switch mode {
 	case config.ModeEC2:
 		ctx.mode = config.ModeEC2
-	case config.ModeOnPrem:
+	case config.ModeOnPrem,config.ModeOnPremise:
 		ctx.mode = config.ModeOnPrem
 	default:
 		log.Panicf("Invalid mode %s. Valid mode values are %s and %s.", mode, config.ModeEC2, config.ModeOnPrem)

programming_language: Go