Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-23511

CVE-2022-23511: Amazon CloudWatch Agent for Windows has Privilege Escalation Vector

7.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-23511
GHSA ID
GHSA-j8x2-2m5w-j939
EPSS Score
0.08311%
CWE
CWE-274
Published
12/12/2022
Updated
4/3/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/aws/amazon-cloudwatch-agentgo< 1.247355.01.247355.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from how the Windows installer (MSI) handled privilege elevation during repairs. The commit diff shows the vulnerable version used a direct PowerShell execution command (UpdateConfigPermission) with 'Impersonate="no"', granting SYSTEM privileges but displaying a visible window. The patched version replaces this with WixQuietExec and proper PowerShell path resolution to prevent UI interaction. This specific CustomAction implementation in the installer configuration was the root cause of the privilege escalation vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t * privil*** *s**l*tion issu* *xists wit*in t** *m*zon *lou*W*t** ***nt *or Win*ows in v*rsions up to *n* in*lu*in* v*.******. W**n us*rs tri***r * r*p*ir o* t** ***nt, * pop-up win*ow op*ns wit* SYST*M p*rmissions. Us*rs wit* **ministr*tiv

Reasoning

T** vuln*r**ility st*ms *rom *ow t** Win*ows inst*ll*r (MSI) **n*l** privil*** *l*v*tion *urin* r*p*irs. T** *ommit *i** s*ows t** vuln*r**l* v*rsion us** * *ir**t Pow*rS**ll *x**ution *omm*n* (`Up**t**on*i*P*rmission`) wit* 'Imp*rson*t*="no"', *r*nt