Description
A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610/6.44.15806. It has been classified as problematic. Affected is an unknown function of the component Uninstallation Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.40.15409, 6.42.15611 and 6.44.15807 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-206880.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CrowdStrike | Falcon | 6.31.14505.0, 6.42.15610, 6.44.15806 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- CrowdStrike Falcon AGENT 6.44.15806 - Uninstall without Installation Token EDB-51146 · local · Mar 30, 2023
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://vuldb.com/?id.206880 vdb-entry
- https://vuldb.com/?ctiid.206880 signature permissions-required
- https://www.modzero.com/modlog/archives/2022/08/22/ridiculous_vulnerability_disclosure_process_with_crowdstrike_falcon_sensor/index.html related
- https://www.modzero.com/advisories/MZ-22-02-CrowdStrike-FalconSensor.txt exploit
- https://youtu.be/3If-Fqwx-4s media-coverage