Chef InSpec Named Pipe Permission Vulnerability Allowing Privilege Escalation

A vulnerability exists in Chef InSpec versions prior to 5.24, where named pipes are created with default Windows access controls that are too permissive. This flaw allows a local attacker to interfere with the pipe connection process and exploit the inadequate access restrictions to gain access to the InSpec execution context. Such an exploitation could lead to elevated privileges or operational disruption.

Impact

Exploitation of this vulnerability could allow a local attacker to gain elevated privileges or disrupt operations by interfering with the InSpec execution context.