Executable Path Injection Vulnerability in osquery by Facebook

CVE-2019-3567

What is CVE-2019-3567?

An injection vulnerability exists in osquery that allows an attacker to modify the extensions.load file, potentially causing the application to execute a malicious binary with elevated SYSTEM permissions. If configurations are not properly secured, an attacker could hard link a folder containing malicious software to a directory that has overly permissive access. A recommended preventive measure is to relocate installations to the 'Program Files' directory on Windows systems to restrict unwarranted write access and protect against exploitation.

References