CVE-2024-52976: 
Elastic Agent vulnerability analysis and mitigation

A security vulnerability identified as CVE-2024-52976 affects Elastic Agent's subprocess, osqueryd, in versions prior to 7.17.25 and 8.15.4. The vulnerability involves the inclusion of functionality from an untrusted control sphere, which has been classified as CWE-829 (Wiz, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.4 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N. This scoring indicates a local attack vector with low attack complexity, requiring high privileges, and no user interaction needed (NVD, Wiz).

The vulnerability allows local attackers to execute arbitrary code through parameter injection in the osqueryd subprocess. The impact primarily affects system integrity, with no direct impact on confidentiality or availability (Wiz).

The vulnerability requires local access and the ability to modify osqueryd configurations to be exploited. The exploitation probability percentile (EPSS) is reported as 2.2 (Wiz).

Elastic has released security updates to address this vulnerability. Users are advised to upgrade to Elastic Agent version 7.17.25 or 8.15.4, depending on their deployment version (Wiz).