McAfee Agent bug lets hackers run code with Windows SYSTEM privileges

McAfee Enterprise (now rebranded as Trellix) has patched a security vulnerability discovered in the company's McAfee Agent software for Windows enabling attackers to escalate privileges and execute arbitrary code with SYSTEM privileges.

McAfee Agent is a client-side component of McAfee ePolicy Orchestrator (McAfee ePO) that downloads and enforces endpoint policies and deploys antivirus signatures, upgrades, patches, and new products on enterprise endpoints.

The company has fixed the high severity local privilege escalation (LPE) flaw tracked as CVE-2022-0166 and discovered by CERT/CC vulnerability analyst Will Dormann issued security updates with the release of McAfee Agent 5.7.5 on January 18.

All McAfee Agent versions before 5.7.5 are vulnerable and allow unprivileged attackers to run code using NT AUTHORITY\SYSTEM account privileges, the highest level of privileges on a Windows system, used by the OS and OS services.

"McAfee Agent, which comes with various McAfee products such as McAfee Endpoint Security, includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that my be controllable by an unprivileged user on Windows," Dormann explained.

"McAfee Agent contains a privileged service that uses this OpenSSL component. A user who can place a specially-crafted openssl.cnf file at an appropriate path may be able to achieve arbitrary code execution with SYSTEM privileges."

Exploitable for evasion, loading malicious payloads

Following successful exploitation, threat actors could persistently execute malicious payloads and potentially evade detection during attacks.

While only exploitable locally, threat actors commonly exploit this type of security flaw during later stages of their attacks, after infiltrating the target machine to elevate permissions for gaining persistence and further compromising the system.

This is not the first time security researchers have found vulnerabilities while analyzing McAfee's Windows security products.

For instance, in September 2021, the company patched another McAfee Agent privilege escalation bug (CVE-2020-7315) discovered by Tenable security researcher Clément Notin that allowed local users to execute arbitrary code and kill the antivirus.

Two years before, McAfee fixed a security vulnerability impacting all editions of its Antivirus software for Windows (i.e., Total Protection, Anti-Virus Plus, and Internet Security) and allowing potential attackers to escalate privileges and execute code with SYSTEM account authority.