Elastic Agent osqueryd Subprocess Code Execution Vulnerability

A vulnerability in Elastic Agent versions through 7.17.24 and 8.15.3 allows local attackers to execute arbitrary code by injecting parameters into the osqueryd subprocess. This issue arises from the inclusion of functionality from an untrusted control sphere, which local attackers can exploit if they have access to modify osqueryd configurations.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of arbitrary code within the context of the Elastic Agent.

Remediation

Users can upgrade to Elastic Agent versions 7.17.25 or 8.15.4 and above to address this vulnerability.