Medium severity · published Apr 23, 2024
CVE-2024-3185
Rapid7 Insight Agent Sensitive Key Exposed To Local Users
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an attacker with local access to a machine with the logging.json file to use that key to authenticate to the platform with high privileges. This was fixed in the Rapid7 platform starting 3 April 2024 via the introduction of a restricted role and the removal of automatic API key generation on installation of an agent.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IA
Insight Agent · Rapid7
through 2024-04-03T12:00:00:000Z · source: vendor
IN
Insightvm · Rapid7
before 6.6.245 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3185
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3185
docs.rapid7.com
https://docs.rapid7.com/insightidr/configure-the-insight-agent-to-send-logs/
More from Insight Agent
7.8
CVE-2026-89325
Rapid7 Insight Agent: Uncontrolled search path element in InsightVM assessment content leads to local privilege escalation
7.8
CVE-2026-14172
Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
7.8
CVE-2026-6482
Local Privilege Escalation via OpenSSL configuration file in Insight Agent
7.8
CVE-2022-0237
Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted…
7.8
CVE-2021-4007
Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path